A knowledge graph-based multi-node collaborative attack identification method

Abstract

The application relates to the technical field of network security, and discloses a multi-node cooperative attack identification method based on a knowledge graph, which comprises the following steps: collecting data from enterprise intranet multi-source security devices, obtaining behavior event sequences through cleaning and timestamp alignment; constructing a dynamic knowledge graph carrying threat attributes and time decay weights through double-layer graph incremental construction, real-time threat intelligence matching and cross-time window behavior pattern aggregation; extracting multi-modal features by adopting heterogeneous graph embedding, a bidirectional long short-term memory network and cross-modal attention fusion, and calculating a reconstruction error abnormality degree through a graph autoencoder; identifying a cooperative attack node cluster by using a residual graph attention network with time sequence causal constraints, and reasoning an attack chain path by using reinforcement learning; and finally completing attack chain verification, threat level evaluation and feedback updating of a detection model. The application can effectively identify time-dispersed, cross-domain cooperative multi-node advanced persistent threat attacks and accurately restore complete attack chain paths.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a method for identifying multi-node collaborative attacks based on knowledge graphs. Background Technology

[0002] Advanced persistent threat (APS) attacks are typically launched by highly organized attack teams, targeting critical infrastructure such as energy and finance, and employing a multi-node collaborative operational model to carry out long-term infiltration. Attackers control multiple internal network hosts to perform reconnaissance, lateral movement, and data theft operations in stages at different times and in different network areas. The behavior of a single controlled node is often disguised as normal business activity, and the true nature of the attack can only be revealed after collaborative analysis of multiple nodes.

[0003] Traditional intrusion detection systems primarily rely on signature-based matching and rule-based single-point behavior assessments, making it difficult to identify distributed, collaborative attack patterns. Existing machine learning-based anomaly detection methods mostly model single data sources, failing to integrate multi-source heterogeneous data such as network traffic, system logs, and endpoint behavior. Some research introduces knowledge graphs for threat intelligence management, but these are mainly used as static knowledge bases, lacking the ability to dynamically extract entities and relationships from real-time data.

[0004] Existing graph neural network methods are mainly for network traffic classification, do not make full use of the multi-hop neighbor aggregation capability to capture multi-node cooperative patterns, lack constraint mechanisms for the temporal causal relationship of cooperative attacks, and cannot associate time-dispersed and space-crossing attack behaviors, resulting in insufficient ability to identify covert multi-node cooperative attacks. Summary of the Invention

[0005] This invention provides a knowledge graph-based method for identifying multi-node collaborative attacks, addressing the technical problems in related technologies such as the lack of a dynamic knowledge graph construction mechanism that integrates threat intelligence and real-time monitoring data, insufficient ability to analyze the correlation of multi-node collaborative attacks, and insufficient depth of graph neural networks in multi-node collaborative pattern recognition.

[0006] This invention provides a multi-node collaborative attack identification method based on knowledge graphs, comprising the following steps: S1: Collect multi-source security data, and obtain behavioral event sequences through data cleaning, timestamp alignment, and feature extraction and transformation; S2, acquire the sequence of behavioral events, and obtain a dynamic knowledge graph carrying threat attributes and time decay weights through two-layer incremental graph construction, real-time threat intelligence matching and association, and cross-time window behavioral pattern aggregation; S3, based on dynamic knowledge graph, extracts topological features through heterogeneous graph embedding, encodes temporal features through bidirectional long short-term memory network, fuses heterogeneous features through cross-modal attention, and calculates the reconstruction error anomaly degree through graph autoencoder, thereby obtaining the multimodal anomaly feature representation of the node; S4, receive a dynamic knowledge graph with multimodal anomaly feature representation, identify attack node clusters through a residual graph attention network with temporal causal constraints and co-correlation analysis, and use reinforcement learning to infer attack chains to obtain co-attack node clusters and attack chain paths. S5, based on the cluster of collaborative attack nodes and the attack chain path, obtains a collaborative attack identification report and an optimized detection model through attack chain integrity verification, threat level assessment, identification report generation, and feedback update of the knowledge graph.

[0007] In a preferred embodiment, S1 includes: Data cleaning is performed on the collected multi-source heterogeneous data. Duplicate records are identified and deleted by comparing hash values ​​based on the combination of key fields of the records. Records missing source IP address, target IP address or timestamp are marked as invalid records and removed. For records with missing timestamps but complete timestamps of adjacent records, a linear interpolation method is used to take the average of the timestamps of the preceding and following records as the complete value; All timestamps are uniformly converted to the UTC standard time format, and the clocks of each data source device are synchronized through the network time protocol. The clock deviation is corrected according to the time difference between the device and the standard time server to achieve alignment.

[0008] In a preferred embodiment, S2 includes: Initialize a two-layer knowledge graph structure. The base layer loads a pre-built threat intelligence knowledge base, which includes malicious IP nodes, attack pattern nodes, and vulnerability nodes and their associated edges. The dynamic layer is initialized as an empty graph structure. The behavior event sequence is processed one by one using a streaming processing method. The source entity and target entity are queried to see if the corresponding node already exists. If not, the asset node or behavior node is created and added to the hash index. If it already exists, the latest activity timestamp and cumulative behavior count are updated. The newly added asset nodes in the dynamic layer are matched with the malicious IP nodes in the basic layer. If the match is successful, a threat association edge is established and the threat tag attribute of the node is marked. The behavior node and the attack pattern node are matched for sequence similarity based on a combination of the longest common subsequence and the edit distance. If the similarity exceeds the preset pattern matching threshold, a pattern association edge is established.

[0009] In a preferred embodiment, S2 further includes: The entire monitoring period is divided into multiple time windows with a fixed step size. An overlapping interval is set between adjacent time windows. For the behavior event sequence of each asset node in each time window, a set of behavior segments consisting of N consecutive behavior types is extracted in an N-gram manner. Each segment is mapped to an integer hash value to form a behavior pattern fingerprint vector. Locality-Sensitive Hash (LSH) algorithm is used to map fingerprint vectors to low-dimensional hash buckets to quickly retrieve candidate similar behavior pattern pairs. Jaccard similarity is calculated for candidate pairs. If the similarity exceeds a preset cross-window threshold, cross-time window association edges are established between the corresponding behavior nodes. A time decay weight mechanism is introduced for all edges in the dynamic knowledge graph. The current weight of an edge is equal to the initial weight multiplied by an exponential decay factor calculated based on the time difference between the edge's latest activity timestamp and the current system time. All edges are traversed periodically, and edges with a current weight lower than a preset pruning weight threshold are removed. Isolated nodes with a degree of zero and a latest activity timestamp exceeding a preset node retention period threshold are also removed.

[0010] In a preferred embodiment, S3 includes: The dynamic knowledge graph is embedded using a heterogeneous graph embedding algorithm based on meta-paths, and multiple meta-path patterns are defined, including asset node to asset node via behavior node, asset node to threat intelligence node via behavior node, behavior node to behavior node via temporal edge, and asset node to behavior node of another time window via cross-time window association edge. Random walks are performed on the knowledge graph based on meta-paths. The selection probability of neighboring nodes is proportional to the current weight of the edge. A heterogeneous Skip-Gram model is used to learn the vector representation of nodes through negative sampling techniques to obtain the graph embedding vector. For each asset node, extract the temporal behavior sequence within a specified time window, encode the type and attributes of the behavior events into an initial feature vector, input it into a bidirectional long short-term memory network, and concatenate the forward and backward final hidden states to obtain the encoding vector of the behavior sequence.

[0011] In a preferred embodiment, S3 further includes: The cross-modal attention fusion module is designed to map the graph embedding vector of the asset node to the query vector through linear transformation, and to map the bidirectional hidden state sequence of the behavior sequence to the key vector sequence and the value vector sequence respectively. Attention scores are calculated by scaling the dot product and then normalized by softmax to obtain attention weights. The value vector sequence is weighted and aggregated according to the attention weights to obtain the aligned temporal feature vector. The graph embedding vector and the aligned temporal feature vector are concatenated and then passed through a fully connected layer and a sigmoid activation function to obtain the fusion gate output. The fusion feature vector is equal to the graph embedding vector multiplied by the fusion gate weight, plus the aligned temporal feature vector multiplied by one minus the fusion gate weight, and then passed through a ReLU activation function to obtain the multimodal feature vector. After the multimodal feature vectors of all nodes are calculated, they are batch input into the graph autoencoder. The encoder uses a graph convolutional network to weighted aggregate the features of the target node and the features of its neighboring nodes and map them to a low-dimensional latent representation space. The decoder maps the low-dimensional latent representation back to the original dimension. The mean squared error is minimized by training with normal behavior node data. During the inference stage, the reconstruction error of each node is calculated as an anomaly score, which is combined with the multimodal feature vectors to form the multimodal anomaly feature representation.

[0012] In a preferred embodiment, S4 includes: A multi-layer residual graph attention network is constructed. The initial feature vector of the node is the multimodal anomaly feature representation. In each layer, the source nodes are grouped according to the incoming edge type for each target node. For each edge type, the feature vectors of the target node and the source node are concatenated and the attention logit value is calculated by the type-specific attention weight matrix and the LeakyReLU activation function. The attention weight is obtained by softmax normalization. The source node features are weighted and aggregated according to the attention weight. A multi-head attention mechanism is used to fuse the aggregated vectors of different edge types to obtain a comprehensive neighbor information representation vector. The target node feature vector input to the current layer is added to the comprehensive neighbor information representation vector to achieve residual connection. After layer normalization, the updated node feature vector is output. During the information aggregation process, the timestamp attributes of the source node and the target node are checked for each edge. If the latest activity timestamp of the source node is later than the latest activity timestamp of the target node, a time-series mask matrix with a mask value of negative infinity is generated. The time-series mask matrix is ​​added to the attention logit value. After softmax normalization, the attention weight of the source node that violates the time-series constraint approaches zero.

[0013] In a preferred embodiment, S4 further includes: After passing through a multi-layer residual graph attention network, the final feature representation of all nodes is extracted. For any pair of nodes, the cosine similarity of the final feature vector is calculated as the feature similarity score. The reciprocal of the shortest path length between two nodes is calculated as the topological proximity score. The number of behavioral events that two nodes jointly participate in within a specified time window is counted as the behavioral association frequency. The comprehensive collaborative association score is calculated by weighted summation of feature similarity score, topological proximity score, and behavioral association frequency. The weight coefficients are obtained by training on the validation set data. A node association graph is constructed, with nodes whose collaborative association scores exceed a preset collaborative association threshold as edges. The Louvain community detection algorithm is used to identify node communities through modularity optimization. Each community corresponds to a potential cluster of collaborative attack nodes.

[0014] In a preferred embodiment, S4 further includes: For each cluster of collaborative attack nodes, the node with the earliest time of the first abnormal activity and the existence of a threat-related edge is selected as the starting point of the attack chain. If there is no node with a threat-related edge, the node with the earliest timestamp of the first abnormal activity is selected as the starting point. The attack chain reasoning is modeled as a Markov decision process, with the state space being the current attack chain path and the set of candidate expansion nodes, and the action space being the selection of candidate nodes to join the attack chain or to terminate the reasoning. The reward function comprehensively considers the collaborative correlation score between the newly added node and the current end node of the chain, the rationality of the attack phase transition, and the path length penalty. A deep Q-network is constructed to learn the optimal inference strategy. The network is trained using experience replay and target network mechanisms. Starting from the starting node, the action with the largest Q value is selected step by step to expand the attack chain until the inference is terminated, the candidate node set is empty, or the preset maximum path length threshold is reached. The nodes in the attack chain path obtained by inference are sorted in chronological order and labeled with the corresponding MITRE ATT&CK attack stage.

[0015] In a preferred embodiment, S5 includes: For each attack chain path, verify whether the number of attack stages it covers reaches the preset stage coverage threshold, verify whether the timestamps of adjacent nodes meet the temporal constraints, and use the graph editing distance algorithm to calculate whether the similarity between the attack chain subgraph and the known attack pattern graph exceeds the preset pattern similarity threshold. For verified attack chains, the attack chain length factor, node number factor, phase coverage integrity factor, sensitive asset importance factor, and attack success probability factor are combined in a weighted linear combination to calculate a comprehensive threat level score, and the threat level is divided according to the score range. The threat labels of nodes in the attack chain are updated to confirmed attack nodes. The initial weights of the edges in the attack chain are multiplied by an enhancement factor to enhance the weights. Newly identified attack patterns are added to the threat intelligence knowledge base. Training samples are constructed using confirmed attack nodes to incrementally train the residual graph attention network and the deep Q network.

[0016] The beneficial effects of this invention are as follows: By using a cross-time window behavior pattern aggregation mechanism, local sensitive hashing and Jaccard similarity retrieval are employed to establish cross-window association edges in the dynamic knowledge graph, connecting time-dispersed attack behavior fragments. This solves the problem that traditional methods cannot associate low- and slow APT attack behaviors across time sequences, enabling low-frequency behaviors that could not trigger the detection threshold within a single time window to form a complete attack path. By using a residual graph attention network with temporal causal constraints, edges that violate temporal constraints are masked during information aggregation. The oversmoothing problem is alleviated by combining residual connections. Then, reinforcement learning is used to infer attack chains, which solves the problem that the lack of temporal constraints in existing graph neural network methods leads to insufficient accuracy in cooperative attack chain inference. This achieves accurate reconstruction of multi-node cooperative attack chain paths. Attached Figure Description

[0017] Figure 1 This is a flowchart of a multi-node collaborative attack identification method based on knowledge graphs according to the present invention; Figure 2 This invention provides a flowchart of a multi-node collaborative attack identification method based on knowledge graphs. Figure 1 ; Figure 3 This invention provides a flowchart of a multi-node collaborative attack identification method based on knowledge graphs. Figure 2 . Detailed Implementation

[0018] The subject matter described herein will now be discussed with reference to exemplary embodiments. It should be understood that these embodiments are discussed only to enable those skilled in the art to better understand and implement the subject matter described herein, and changes may be made to the function and arrangement of the elements discussed without departing from the scope of this specification. Various processes or components may be omitted, substituted, or added as needed in the examples. Furthermore, some features described in the examples may be combined in other examples.

[0019] At least one embodiment of the present invention discloses a multi-node collaborative attack identification method based on knowledge graphs, such as... Figures 1 to 3 As shown, it includes the following steps: S1: Collect multi-source security data, and obtain behavioral event sequences through data cleaning, timestamp alignment, and feature extraction and transformation; The system collects inbound and outbound traffic data from network boundaries from firewall devices deployed within the enterprise intranet, including fields such as source IP address, destination IP address, source port, destination port, protocol type, packet size, number of bytes transmitted, and connection timestamp. It also collects security alarm data triggered by intrusion detection systems, including alarm type, severity, attack signature, source and destination information, and alarm timestamp. Furthermore, it collects terminal behavior audit data from security agents on host terminals, including process creation events, file access events, registry modification events, and network connection events, with each event recording process identifier, user identifier, operation object, operation type, and event timestamp. Finally, it collects system logs from server and network devices from system log servers, including login events, permission change events, service start / stop events, and configuration modification events, recording event type, user information, host information, and log timestamp.

[0020] Data cleaning is performed on the collected multi-source heterogeneous data. All data records are traversed, and duplicate records are identified and deleted. Duplicate determination is based on hash value comparison of key field combinations. Records missing key fields such as source IP address, destination IP address, and timestamp are marked as invalid and removed from the dataset. For records with missing timestamps but complete timestamps of adjacent records, a linear interpolation method is used, taking the average of the preceding and following timestamps as the completion value. For cases where multiple consecutive records have missing timestamps, the timestamps are estimated based on the average event generation rate of the data source. Timestamp formats differ between data sources, some using UTC time and others using local time, with precision varying between milliseconds and seconds. All timestamps are uniformly converted to the UTC standard time format with millisecond precision. Clocks of all data source devices are synchronized via a network time protocol. For devices with clock deviations, clock deviation correction is performed based on the time difference between the device and the standard time server, adding or subtracting the deviation value from the timestamp to achieve alignment.

[0021] Key fields are extracted from the cleaned and aligned data. For network traffic data, five-tuple information is extracted, including source IP address, destination IP address, source port, destination port, and protocol type. Traffic statistics, including packet count, transmitted bytes, and connection duration, are also extracted. For intrusion detection alarm data, the attack type, severity, and involved source and destination IP addresses are extracted. For endpoint behavior data, the complete process path, parent process identifier, file path of the operation, and target address of the network connection are extracted. For system log data, the event type, user account, login source IP address, and target object of the operation are extracted. The extracted key fields are transformed according to a predefined data pattern. A globally unique identifier is generated for each behavior event, using a combination of timestamp and source device identifier to generate a UUID. The event type is determined based on the source and content of the event, including predefined categories such as network connection, process execution, file operation, system login, permission change, and alarm triggering. The process identifies the source and target entities involved in the event. For network connection events, the source entity is the host corresponding to the source IP address, and the target entity is the host or external service corresponding to the target IP address. For process execution events, the source entity is the parent process, and the target entity is the child process. For file operation events, the source entity is the process performing the operation, and the target entity is the file being operated on. Other attribute information of the event is organized into an attribute dictionary, including key-value pairs such as port number, protocol type, file path, and operation type. The transformed data is organized into a standardized behavioral event record format. Each behavioral event record contains a unique event identifier, event type label, source entity identifier, target entity identifier, event occurrence timestamp, and attribute dictionary. All behavioral event records are arranged in ascending order of timestamps, forming a time-series behavioral event sequence output.

[0022] S2, acquire the sequence of behavioral events, and obtain a dynamic knowledge graph carrying threat attributes and time decay weights through two-layer incremental graph construction, real-time threat intelligence matching and association, and cross-time window behavioral pattern aggregation; Initialize a two-layer knowledge graph structure. The base layer loads a pre-built threat intelligence knowledge base, obtaining known malicious IP address lists, malicious domain name lists, attack tool signature databases, vulnerability information databases, and attack pattern databases from public threat intelligence platforms and commercial threat intelligence subscription services. Create a malicious IP node for each malicious IP address, with node attributes including IP address, affiliated organization, threat type, first discovery time, and confidence score. Create an attack pattern node for each known attack pattern, with node attributes including pattern name, corresponding MITRE ATT&CK technical ID, attack stage, and typical behavior sequence. Create a vulnerability node for each vulnerability, with node attributes including CVE ID, vulnerability description, affected system version, and exploitation difficulty. Establish association edges between threat intelligence nodes, such as establishing usage relationship edges between malicious IP nodes and their commonly used attack pattern nodes, and establishing exploitation relationship edges between attack pattern nodes and the vulnerability nodes they exploit. The dynamic layer is initialized as an empty graph structure, ready to receive nodes and edges extracted from real-time behavioral event sequences.

[0023] A streaming approach is used to process events in a standardized sequence of behavioral events one by one. For each newly arriving behavioral event, the source entity identifier and target entity identifier involved in the event are first extracted. A hash index is then used to quickly query the dynamic layer graph to see if corresponding nodes for the source and target entities already exist. The hash index uses the entity identifier as the key and the node object as the value. If the source entity identifier does not exist in the hash index, the entity type is determined. If the entity is an IP address or host identifier, an asset node is created. The node attributes include the entity identifier, the node type is set to asset, the first activity timestamp is set to the current event timestamp, the latest activity timestamp is set to the current event timestamp, and the cumulative behavior count is initialized to one. The created asset node is added to the node set of the dynamic layer graph, and the node is also added to the hash index. If the entity is a process or file, a behavioral node is created. The node attributes include the entity identifier, the node type is set to behavior, the associated asset node identifier, the behavior type, the first occurrence timestamp, the latest occurrence timestamp, and the occurrence count is initialized to one. The behavioral node is added to the graph and the hash index. If the source entity identifier already exists in the hash index, retrieve the corresponding node object, update the node's latest activity timestamp to the current event timestamp, increment the node's cumulative behavior count, and if the event contains new attribute information, merge the attribute information into the node's attribute dictionary. Perform the same query, create, or update operations on the target entity.

[0024] Establish or update associated edges between the source and target entity nodes. Determine the relationship type of the edge based on the type of the behavioral event. If the event type is network connection, set the edge type to network communication; if the event type is process execution, set the edge type to process creation; if the event type is file operation, set the edge type to file access. Check the graph to see if an edge of the same type from the source node to the target node already exists. If the edge does not exist, create a new edge. Edge attributes include edge type, creation timestamp set to the current event timestamp, latest activity timestamp, initial weight set to 1, current weight set to 1, and a list of associated behavioral events. Add the current event identifier to the list and add the new edge to the edge set of the graph. If the edge already exists, update the latest activity timestamp of the edge, append the current event identifier to the list of associated behavioral events of the edge, and increase the initial weight of the edge. Establish temporal correlation edges based on the timestamp order of behavioral events. For multiple behavioral nodes issued by the same asset node, establish temporal correlation edges between the behavioral nodes according to the order of their timestamps. The temporal correlation edge represents the temporal sequence of the behavior. The edge attribute includes the time interval, which is calculated as the timestamp of the later behavior minus the timestamp of the earlier behavior. Establish causal correlation edges based on the semantic logic of the behavioral events. If the output of one behavioral event is the input of another behavioral event, then a causal edge is established between the corresponding behavioral nodes. For example, if process A creates file B and process C reads file B, then a causal edge is established between the file creation behavioral node of process A and the file reading behavioral node of process C.

[0025] Newly added asset nodes in the dynamic layer are matched and associated with threat intelligence nodes in the base layer in real time. For each newly created asset node, its IP address attribute is extracted, and the IP address is queried in the malicious IP node set of the base layer to see if it exists. If the IP address matches successfully, a threat association edge is established between the asset node and the corresponding malicious IP node, with the edge type set to match malicious IP. At the same time, the threat label attribute of the asset node is updated, marking it as a suspected malicious node, and the threat type and confidence score of the malicious IP node are copied to the asset node's attributes. For each newly created behavior node, its behavior type and behavior sequence features are extracted, and pattern matching is performed with the attack pattern nodes in the base layer. The attack pattern nodes store typical attack behavior sequence templates. A sequence similarity algorithm is used to calculate the similarity between the current behavior sequence and the attack pattern sequence. The similarity algorithm is based on a combination of the longest common subsequence and edit distance. If the similarity exceeds the pattern matching threshold, a pattern association edge is established between the behavior node and the matched attack pattern node, with the edge type set to match the attack pattern. The threat label of the behavior node is updated, marking it as a suspected attack behavior, and the MITRE ATT&CK technical number and attack stage information of the attack pattern node are copied to the behavior node's attributes.

[0026] Because APT attacks are characterized by slow and phased penetration, the behavioral fragments performed by attackers in different time windows are often insufficient to trigger detection thresholds within a single window. However, structural similarities exist between behavioral sequences across windows, providing association information that entity relationship extraction within a single time window cannot capture. Therefore, after extracting entities and relationships within a single time window, a cross-time window behavioral pattern aggregation mechanism is introduced. The entire monitoring period is divided into multiple time windows with fixed step sizes, and overlapping intervals are set between adjacent time windows to prevent attack behavior from being truncated by window boundaries. Behavioral pattern fingerprints are extracted from the behavioral event sequences of each asset node within each time window. The extraction method involves extracting a set of N consecutive behavioral fragments based on the type label order of the behavioral events using an N-gram approach. The value of N is determined based on the typical behavioral sequence length of the attack phase; the default value is statistically obtained based on the average phase behavioral sequence length of historical attack samples in the deployed environment. Each fragment in the behavioral fragment set is mapped to an integer hash value, and all hash values ​​are combined to form the behavioral pattern fingerprint vector of that asset node within that time window. After obtaining the behavioral pattern fingerprint vectors for each time window, performing precise similarity comparisons pairwise across all windows results in computational overhead that increases quadratically with the number of windows, making real-time implementation impractical in large-scale network environments. Therefore, Locality Sensitive Hashing (LSH) is employed to perform approximate similarity retrieval on the fingerprint vectors. LSH constructs multiple families of hash functions to map high-dimensional fingerprint vectors to low-dimensional hash buckets. Vectors with high similarity are more likely to fall into the same hash bucket, thus quickly finding candidate similar behavioral pattern pairs without performing full pairwise comparisons. For the retrieved candidate similar behavioral pattern pairs, their precise Jaccard similarity is further calculated. Jaccard similarity equals the intersection size of the two behavioral fragment sets divided by the union size. If the Jaccard similarity exceeds the cross-window similarity threshold, the behavioral patterns within the two time windows are considered to belong to different stages of the same attack activity. In the dynamic knowledge graph, a cross-time window association edge is established between the behavioral nodes of the corresponding two time windows. The edge type is set to cross-window behavioral association, and the edge attributes record the start and end timestamps of the two time windows, the Jaccard similarity value, and the content of the involved behavioral fragments. The establishment of cross-time window connections enables scattered behavioral fragments that could not form a complete attack chain within a single time window to be connected in the graph, providing a cross-temporal graph structure foundation for subsequent multi-hop neighbor aggregation in residual graph attention networks.

[0027] A time-decay weighting mechanism is introduced for all edges in the dynamic layer graph. The current weight of an edge reflects the current importance of the relationship it represents; as time progresses, the importance of historical behaviors gradually decreases. The current weight of an edge is calculated as follows: based on the edge's initial weight, it is multiplied by a decay factor calculated using the time difference between the edge's latest activity timestamp and the current system time. The decay factor adopts an exponential decay function, i.e.

[0028] in Let the weight of the edge be at the current moment. The initial weight of the edge is equal to the cumulative number of historical behavioral events associated with that edge. The decay rate parameter controls how quickly the weights decay over time. The time difference between the latest activity timestamp of the edge and the current system time, in hours. The value is determined based on prior knowledge of the attack duration in the application scenario. For scenarios requiring rapid response, Increasing the value accelerates the decay rate, which is beneficial for slow penetration scenarios requiring long-term tracking. Decreasing the value slows down the decay rate; the default value is estimated based on the average duration of historical attack events in the deployed environment. Graph pruning is performed periodically, triggered at fixed time intervals. All edges in the dynamic layer graph are traversed, and the current weight of each edge is calculated. If the current weight of an edge is lower than the pruning weight threshold, the edge is removed from the graph to free up storage space. Simultaneously, all nodes are traversed, and isolated nodes with zero degree are identified. If the latest activity timestamp of an isolated node is more than the node retention period threshold from the current time, the node is also removed. A graph database supporting distributed storage and high-concurrency queries is used to store and manage the dynamic knowledge graph. Node and edge data are persistently stored, and indexes based on node identifiers and edge types are established to accelerate query operations. The graph database is deployed in a cluster mode, achieving efficient storage and fault tolerance for large-scale graphs through data sharding and replication mechanisms. Output a continuously updated dynamic knowledge graph containing asset nodes, behavior nodes, and threat intelligence nodes. Edges include network communication edges, process creation edges, file access edges, time-series correlation edges, causal correlation edges, threat correlation edges, pattern correlation edges, and cross-time window correlation edges. Each node and edge carries rich attribute information and time decay weights for use in subsequent steps.

[0029] S3, based on dynamic knowledge graph, extracts topological features through heterogeneous graph embedding, encodes temporal features through bidirectional long short-term memory network, fuses heterogeneous features through cross-modal attention, and calculates the reconstruction error anomaly degree through graph autoencoder, thereby obtaining the multimodal anomaly feature representation of the node; Dynamic knowledge graphs contain various types of nodes, including asset nodes, behavior nodes, and threat intelligence nodes, as well as various types of edges, such as network communication edges, temporal association edges, threat association edges, and cross-time window association edges. If a homogeneous graph embedding algorithm is used, treating all nodes and edges as the same type, the semantic information carried by the node and edge types will be lost. This leads to confusion in the vector representations of different types of nodes, making it impossible to distinguish the different roles of asset nodes and threat intelligence nodes in collaborative attacks. Therefore, a meta-path-based heterogeneous graph embedding algorithm is adopted for dynamic knowledge graphs. By constraining random walk paths through meta-paths, the walk sequence preserves the semantic structure of node and edge types. First, we define meta-path patterns. Meta-paths describe the combined paths of nodes and edge types in the graph. For the collaborative attack identification task, we design multiple meta-paths: The first meta-path is from an asset node to an asset node via a behavior node, capturing the implicit association between two assets through common behaviors; the second meta-path is from an asset node to a threat intelligence node via a behavior node, capturing the matching relationship between asset behaviors and known threat patterns; the third meta-path is from a behavior node to a behavior node via a temporal edge, capturing the temporal dependency relationship of behaviors; the fourth meta-path is from an asset node to a behavior node in another time window via a cross-time window association edge. By utilizing the cross-time window association edges already established in the dynamic knowledge graph, we incorporate the scattered behaviors of the same asset at different time stages into the same traversal path, enabling the embedded vector to perceive cross-temporal attack behavior associations. Based on the defined meta-paths, a meta-path-guided random walk is performed on the knowledge graph. For each starting node, a neighboring node that meets the meta-path constraints is selected as the next walk target according to the current node type and meta-path pattern. The selection probability of a neighboring node is proportional to the current weight of the edge. Edges with higher weights have a higher probability of being selected. A fixed-length random walk is performed to generate a node sequence. Each node serves as the starting node to generate multiple walk sequences. All walk sequences are collected to form the training corpus. A heterogeneous Skip-Gram model is used to learn the vector representation of nodes. The model aims to maximize the probability of node co-occurrence in the walk sequence. For each central node in the walk sequence, its neighboring nodes within the context window are predicted. The objective function is defined as the sum of the likelihoods of all central nodes' context nodes. The objective function is optimized through negative sampling. For each positive sample node pair, several negative sample nodes are randomly sampled. The negative sample nodes are not in the same context window as the central node. A binary classification problem is constructed using a logistic regression model. Positive samples are labeled as one, and negative samples are labeled as zero. The vector parameters of the nodes are updated using the gradient descent algorithm. After multiple rounds of iterative training, each node obtains a fixed-dimensional vector representation. This vector representation encodes the node's structural position in the graph topology, neighbor relationships, and node type semantics. Nodes with similar topological positions and neighbor structures are close in distance in the vector space.

[0030] Graph embedding vectors capture the structural positional features of nodes within the graph topology, but they cannot reflect the behavioral evolution patterns of nodes over time. When attackers perform operations such as lateral movement and privilege escalation, their behavioral sequences exhibit clear temporal dependencies, with preceding actions creating conditions for subsequent actions. Topological features alone cannot distinguish between normal, high-frequency access nodes and attack intermediate stepping stone nodes. Therefore, for each asset node in the dynamic knowledge graph, we extract its associated behavioral event sequence within a specified time window. The time window length is set according to the application scenario: several hours for fast attack scenarios and several days for slow penetration scenarios. Starting from the asset node, we traverse all its connected edges, collecting the behavioral event identifiers associated with each edge. Events within the time window are filtered based on the timestamps of the behavioral events, and the filtered behavioral events are arranged in ascending order of timestamps to form a temporal behavioral sequence. For each behavioral event in the temporal behavioral sequence, feature encoding is performed to extract the type attribute of the behavioral event. The behavioral type is mapped to a one-hot encoded vector. If the system defines M behavioral types, the one-hot encoded vector is M-dimensional, with the corresponding type position being 1 and the rest being zero. Attributes such as port number, protocol type, and file extension involved in the behavioral event are extracted. These discrete attributes are converted into low-dimensional continuous vectors through a learnable embedding matrix. The multiple attribute vectors of the behavioral event are concatenated to form the initial feature vector of the behavioral event. Since there are bidirectional dependencies in the attack behavioral sequence, such as an abnormal file reading behavior, its abnormality depends on both the previous process creation behavior and the subsequent network outgoing behavior. Unidirectional LSTM can only capture the forward temporal dependency and ignore the reverse context. Therefore, the feature vector sequence of the temporal behavioral sequence is input into a bidirectional long short-term memory network. A bidirectional LSTM consists of two components: a forward LSTM and a backward LSTM. The forward LSTM processes the feature vector sequentially from the start to the end of the sequence. At each time step, the forward LSTM unit receives the feature vector of the current time step and the hidden state of the previous time step. It updates the hidden state through the calculation of forget gates, input gates, and output gates. The forget gate determines how much information to retain from the previous hidden state, the input gate determines how much information from the current input is added to the hidden state, and the output gate determines how much information from the hidden state is output. The forward LSTM captures the forward temporal dependencies of the behavioral sequence. The backward LSTM processes the feature vector in reverse order from the end to the start of the sequence, using the same LSTM unit structure, capturing the backward temporal dependencies of the behavioral sequence. At the last time step of the sequence, the final hidden states of the forward and backward LSTMs are extracted and concatenated to obtain the encoded vector of the behavioral sequence. This encoded vector combines the forward and backward temporal dependency features of the sequence.

[0031] Graph embedding vectors and behavior sequence encoding vectors originate from the graph topology space and temporal behavior space, respectively. Their feature dimensions and semantic meanings differ. Direct concatenation would treat both features as equals, failing to dynamically adjust the attention given to specific time steps in the behavior sequence based on the node's topological location, leading to insufficient fusion. To address this, a cross-modal attention fusion module is designed, using the graph embedding vector as the query to drive the model to selectively extract temporal information most relevant to the current node's topological features from the behavior sequence. The graph embedding vector of the asset node is mapped to the query space via a linear transformation matrix, yielding the query vector Q. The hidden states of each time step in the bidirectional hidden state sequence of the behavior sequence are mapped to the key space and value space via linear transformation matrices, yielding the key vector sequence K and the value vector sequence V. Attention scores are calculated between the query vector and each key vector using a scaled dot product method, i.e., the dot product of the query vector and the key vector is divided by the square root of the key vector's dimension. This scaling operation prevents excessively large dot product values ​​from causing gradient vanishing. Softmax normalization is applied to the attention scores for all time steps to obtain the attention weight distribution. The attention weights reflect the relevance of different time steps in the behavior sequence to the current node's topological features. The value vector sequence is weighted and aggregated based on attention weights. The aggregated vector is equal to the sum of the products of the value vectors at all time steps and their corresponding attention weights. The aggregated vector represents the temporal features of behaviors aligned with the graph topology. Time steps related to the topology are strengthened, while irrelevant time steps are suppressed. After attention alignment, a gated fusion unit is designed to achieve adaptive fusion. The graph embedding vector and the aligned temporal feature vector are concatenated and input into a fully connected layer. After passing through a sigmoid activation function, the output of the fusion gate is obtained. The output value of the fusion gate is between zero and one, representing the fusion weight of the graph topology features. The fusion weight of the temporal features is one minus the fusion gate output. The fused feature vector is equal to the graph embedding vector multiplied by the fusion gate weight plus the aligned temporal feature vector multiplied by the temporal weight. The fused feature vector is then passed through a nonlinear transformation layer and a ReLU activation function to obtain the final multimodal feature vector.

[0032] Multimodal feature vectors integrate the topological and temporal behavioral features of nodes, but they do not yet quantify the degree of anomalousness. General anomaly detection algorithms (such as distance- or density-based methods) are not aware of graph structure and cannot use neighbor relationships to correct for anomalousness. For example, if a node with anomalous behavior has normal neighbors, its anomalousness should be appropriately reduced; conversely, if known threat nodes exist among its neighbors, its anomalousness should be amplified. Therefore, after calculating the multimodal feature vectors of all nodes, the multimodal feature vectors of all nodes, along with the adjacency structure of the knowledge graph, are batch-input into a graph autoencoder. During reconstruction, the graph autoencoder utilizes both the node's own features and neighbor structure information, enabling the reconstruction error to reflect the degree to which a node deviates from its normal state within the context of the graph structure. The graph autoencoder consists of an encoder and a decoder. The encoder maps the multimodal feature vectors of nodes and their neighbor structure in the knowledge graph to a low-dimensional latent representation space. The decoder reconstructs the multimodal feature vectors of nodes from the low-dimensional latent representation; a larger reconstruction error indicates a more anomalous node. The encoder employs a graph convolutional network structure. For each target node, it collects the multimodal feature vectors of its one-hop neighbors. Graph convolution operations are used to weight and aggregate the target node's own features with those of its neighbors. The aggregation weights are normalized from the current weights of the edges between the target and neighbor nodes. The aggregated vector is then passed through a fully connected layer and a ReLU activation function to obtain the node's low-dimensional latent representation vector. The dimension of the latent representation vector is lower than that of the multimodal feature vector, creating an information bottleneck and forcing the encoder to learn the essential characteristics of node behavior. The decoder is a multi-layer fully connected network that maps the node's low-dimensional latent representation vector back to the same dimension as the multimodal feature vector layer by layer, resulting in a reconstructed multimodal feature vector. The training phase of the graph autoencoder primarily uses data from nodes exhibiting normal behavior. The training objective is to minimize the reconstruction error, defined as the mean squared error between the original and reconstructed multimodal feature vectors, i.e., the mean of the sum of the squares of the differences in each dimension between the original and reconstructed vectors. The parameters of the encoder and decoder are updated using a gradient descent algorithm, enabling the model to learn the low-dimensional representation patterns of normal node behavior. The training data sources include normal node samples annotated in publicly available APT attack assessment datasets, as well as baseline data of normal behavior generated in a test environment using attack simulation tools, ensuring that the training data covers typical normal business behavior patterns within the enterprise intranet. During the inference phase, the multimodal feature vectors of all asset nodes are batch-input into the trained graph autoencoder, and the reconstruction error of each node is calculated as the node's anomaly score. Nodes with high reconstruction errors indicate that their behavior patterns deviate from the normal baseline in the context of the graph structure, indicating a high degree of anomaly; nodes with low reconstruction errors indicate that their behavior patterns are close to the normal baseline, indicating a low degree of anomaly.The multimodal feature vectors and anomaly scores of asset nodes are combined to form multimodal anomaly feature representations of nodes. These multimodal anomaly features are then used to update the attributes of the corresponding nodes in the dynamic knowledge graph, resulting in a dynamic knowledge graph with multimodal anomaly features.

[0033] S4, receive a dynamic knowledge graph with multimodal anomaly feature representation, identify attack node clusters through a residual graph attention network with temporal causal constraints and co-correlation analysis, and use reinforcement learning to infer attack chains to obtain co-attack node clusters and attack chain paths. In dynamic knowledge graphs with multimodal anomaly features, the anomaly features of a single node only reflect the degree of deviation of its own behavior and cannot perceive its association patterns with other nodes in a cooperative attack network. In cooperative attacks, the behaviors of each node cooperate, and the cooperation of nodes is reflected in the feature distribution of multi-hop neighbors, which requires layer-by-layer aggregation of neighbor information through a multi-layer graph neural network to capture. However, as the number of network layers increases, node features tend to smooth out, and the representations of different nodes gradually become similar, leading to a decrease in discriminability. This is an inherent defect of standard graph attention networks when stacked at deep layers. To address this, a multi-layer residual graph attention network is constructed. Residual connections are used to directly add the input features back to the output after aggregation at each layer, preserving the original feature information of the nodes and alleviating the oversmoothing problem. The dynamic knowledge graph is used as the input graph structure, with the initial feature vectors of the nodes being multimodal anomaly features. Edges in the graph are initialized based on edge type and time decay weights. The number of network layers is determined by the maximum number of hops between cooperative attack nodes to be captured. The default value is obtained by statistically analyzing the average path length between cooperative nodes in historical attack cases in the deployed environment. Each additional layer can aggregate information from more distant neighbors. In each layer of the residual graph attention network, information aggregation is performed on each target node. First, all source nodes connected to the target node's incoming edges are collected. The source nodes are grouped according to the type of the incoming edges; different edge types represent different types of relationships, and information aggregation for each relationship is processed separately. For each edge type, a type-specific attention coefficient is calculated. This coefficient measures the importance of the source node to the target node. The feature vectors of the target node and the source nodes are concatenated to form a concatenated vector. This concatenated vector is then input into a type-specific attention weight matrix to obtain a linearly transformed vector. The LeakyReLU activation function is applied to the transformed vector to obtain the attention logit value. The LeakyReLU function retains a small slope in the negative region to prevent neuron death. The attention logit values ​​of all source nodes for the current edge type are softmax normalized. The normalized value is the attention weight, and the sum of the attention weights of all source nodes is one. The feature vectors of the source nodes are then weighted and aggregated according to the attention weights. The aggregated vector is equal to the sum of the products of the feature vectors of all source nodes and their corresponding attention weights, resulting in the neighbor information aggregation vector for that edge type. A multi-head attention mechanism is used to fuse the neighbor information aggregation vectors of different edge types. An attention head is assigned to the aggregation vector of each edge type. Each attention head performs a linear transformation on the aggregation vector through a learnable weight matrix. The outputs of all attention heads are concatenated and mapped to a unified dimension through the output weight matrix to obtain a comprehensive neighbor information representation vector.A residual connection mechanism is introduced, which adds the target node feature vector input to the current layer to the aggregated neighbor information representation vector. The residual connection allows the gradient to flow directly to the previous layer, alleviating the training difficulty and oversmoothing problem of deep networks. Layer normalization is performed on the vector after residual connection. Layer normalization calculates the mean and variance of each dimension of the vector, and normalizes the vector to a distribution with a mean of zero and a variance of one. Then, it is adjusted by learnable scaling and translation parameters. Layer normalization stabilizes the training process and outputs the updated target node feature vector of the current layer.

[0034] A temporal causal constraint mechanism is designed to ensure that information transmission conforms to the temporal order of the attack chain. During information aggregation in the graph attention network, for each edge, the timestamp attributes of the source and target nodes are checked. If the latest activity timestamp of the source node is later than that of the target node, the edge violates the temporal constraint, indicating that a later action should not affect an earlier action. A temporal mask matrix is ​​generated, with rows corresponding to target nodes and columns corresponding to source nodes. If an edge satisfies the temporal constraint, the mask value is set to zero; if it violates the temporal constraint, the mask value is set to negative infinity. When calculating the attention coefficients, the temporal mask matrix is ​​added to the attention logit value. For positions with a mask value of negative infinity, the attention logit value becomes negative infinity. After softmax normalization, the attention weights approach zero, and the information contribution of source nodes violating the temporal constraint to the target node is masked, ensuring that only actions that occur earlier in time transmit information to subsequent actions.

[0035] After propagation through multiple layers of residual graph attention networks, the feature vector of each node incorporates information from its multi-hop neighbors. In the final layer of the network, the final feature representation of all nodes is extracted. The final feature vector of a node contains its global context information in the cooperative attack network. The cooperative association degree between node pairs is calculated. This degree comprehensively evaluates the degree of cooperation between nodes. For any node pair in the knowledge graph, the final feature vectors of the two nodes are extracted, and the cosine similarity of the feature vectors is calculated. The cosine similarity is equal to the dot product of the two vectors divided by the product of their magnitudes. The similarity value is between -1 and 1; a larger value indicates greater feature similarity. The cosine similarity is used as the feature similarity score. The topological proximity of node pairs in the graph is calculated, using the reciprocal of the shortest path length as the proximity score. The shortest path length between two nodes is calculated using a graph traversal algorithm. If the nodes are not connected, the path length is set to infinity, and the proximity score is zero. If the nodes are directly connected, the path length is one, and the proximity score is one. The shorter the path length, the higher the proximity score. The algorithm counts the frequency of behavioral associations between nodes within a specified time window. It iterates through the behavioral events associated with two nodes and counts the number of jointly participated or sequentially related behavioral events within the time window. A higher frequency of behavioral associations indicates more frequent node interaction. A comprehensive collaborative association score is calculated by weighting and summing the feature similarity score, topological proximity score, and behavioral association frequency. The weight coefficients of the three scores are obtained through training on the validation set data, and these weight coefficients reflect the contribution of different factors to the collaborative relationship.

[0036] Based on the collaborative association score between nodes, a node association graph is constructed. The nodes in the node association graph are the asset nodes in the original knowledge graph, and the edges of the node association graph are the node pairs whose collaborative association scores exceed the collaborative association threshold. The weight of the edge is the collaborative association score. The Louvain community detection algorithm is used to identify highly cohesive node communities in the node association graph. The Louvain algorithm is a community detection method based on modularity optimization. The algorithm consists of two phases. The first phase is local optimization. Initially, each node forms its own community. Each node is traversed, and attempts are made to move the node to the community of its neighboring nodes. The change in modularity before and after the move is calculated. Modularity measures the difference between the density of edges within the community and the expected density of the random graph. The move operation that maximizes the modularity gain is selected. If there is no move with a positive gain, the node remains in the current community. The traversal is repeated until no node moves. The second phase is community aggregation. The communities identified in the first phase are used as new super nodes. The sum of the edge weights between nodes within a community is used as the self-loop weight of the super node, and the sum of the edge weights between communities is used as the edge weight between super nodes. A new community graph is constructed. The local optimization of the first phase is repeated on the new community graph. The two phases are iterated until the modularity no longer increases. Finally, a hierarchical community structure is obtained. Each community corresponds to a potential cluster of cooperative attacking nodes. Nodes within a community are highly correlated, while the correlation between nodes between communities is relatively weak.

[0037] For each identified cluster of coordinating attack nodes, the complete attack chain path is inferred. The choice of the starting point of the attack chain directly affects the correctness of the inference direction. If a high-anomaly node at the end is used as the starting point, the attack chain will be inferred backward along the data theft direction, making it impossible to reconstruct the true attack intrusion path. Therefore, the node with a threat-related edge and the earliest first abnormal activity time in the node cluster is prioritized as the starting point. A threat-related edge indicates that the node's IP address has a communication record with a known malicious C2 server or malicious IP in the base layer threat intelligence. Such nodes are usually the initial entry point where attackers first establish contact, and their first abnormal activity time is earlier than subsequent lateral movement nodes. If there is no node with a threat-related edge in the node cluster, the node with the earliest first abnormal activity timestamp is selected as the starting point to locate the initial penetration point of the attack in the time dimension. This starting point selection strategy effectively links with the threat intelligence matching mechanism established in the dynamic knowledge graph to ensure that the attack chain inference starts from the true initial entry point.

[0038] An attack chain reasoning method based on reinforcement learning is adopted, which models the attack chain reasoning as a Markov decision process. The state space is defined as the currently reasoned attack chain path and the set of candidate expansion nodes. The state includes the node sequence in the current chain, the attack stage label of the node, and the cumulative reward value of the chain. The action space is defined as selecting a node from the candidate node set to join the attack chain or terminating the reasoning. The candidate node set consists of the neighbor nodes of the current chain's end node. The reward function comprehensively considers multiple factors. The higher the cooperative correlation score between the new node and the current chain's end node, the larger the positive reward is given. The rationality of the transition between the attack stage corresponding to the new node and the attack stage of the current chain's end node is judged according to the typical transition sequence of attack stages in the MITRE ATT&CK framework. A reasonable transition is given a positive reward, and an unreasonable transition is given a negative reward. A small negative reward is given for each additional node in the path to avoid the path becoming too long and causing the reasoning to diverge.

[0039] A deep Q-network is constructed to learn the optimal inference strategy. The deep Q-network is a multi-layer fully connected neural network. Its input is the feature representation of the current state, including the feature vector sequence of nodes in the current chain, the chain length, the cumulative co-association degree of the chain, and the set of attack stages covered by the chain. The output is the Q-value for each candidate action, representing the expected cumulative reward for performing that action in the current state. The training data for the deep Q-network comes from three sources: first, attack chain path samples labeled in publicly available APT attack evaluation datasets, used to construct the initial training set; second, simulated attack chain data generated in a test environment using attack simulation tools, used to expand the training set to cover diverse attack patterns; and third, real attack chain paths manually verified in a subsequent feedback mechanism, used as incremental training samples to continuously optimize the model. The data from these three sources jointly ensures the trainability of the deep Q-network in scenarios with scarce samples. A deep Q-network is trained using an experience replay and target network mechanism. Experience replay stores historical state transition samples; each sample includes the current state, the action performed, the reward obtained, the next state, and whether the process terminates. During training, batches of samples are randomly sampled from the experience replay buffer, and a target Q-value is calculated. The target value equals the current reward plus a discount factor multiplied by the maximum Q-value for the next state. If the next state is termination, the target value is simply the current reward. Network parameters are updated by minimizing the mean squared error loss function between the Q-value and the target value. The target network is a copy of the Q-network, and its parameters are periodically copied from the Q-network to calculate the target value, stabilizing the training process. The deep Q-network employs a pre-training and fine-tuning strategy. It is first pre-trained using public datasets and simulated attack data to give the model basic attack phase transition inference capabilities. Then, it is fine-tuned using subsequent real-world feedback samples to adapt the model to attack patterns specific to the deployment environment.

[0040] Attack chain inference is performed using a pre-trained deep Q-network. Starting from the initial node, the current state is input into the Q-network to obtain the Q-values ​​of all candidate actions. A greedy strategy is used to select the action with the highest Q-value, and the selected action is executed. The corresponding node is added to the attack chain, and the state is updated, including updating the node sequence, cumulative reward, and candidate node set. If the selected action terminates the inference, the candidate node set is empty, or the maximum path length threshold is reached, the inference ends, and the current attack chain path is output. Otherwise, the inference process is repeated. The inferred attack chain path is post-processed. The nodes in the attack chain are sorted chronologically according to their timestamps in the original knowledge graph. Each node in the attack chain is labeled with the corresponding MITRE ATT&CK attack stage. Based on the node's behavior type and threat attributes, techniques and tactics in the ATT&CK framework are matched, and a set of identified cooperative attack node clusters is output. Each node cluster contains a list of nodes and the relationships between nodes. The attack chain path corresponding to each node cluster is output. The path is a node sequence, with nodes arranged chronologically and labeled with attack stages.

[0041] S5, based on the cluster of cooperative attack nodes and the attack chain path, obtains a cooperative attack identification report and an optimized detection model through attack chain integrity verification, threat level assessment, identification report generation, and feedback update of the knowledge graph; For each identified attack chain path, integrity verification is performed to verify whether the attack chain covers the key stages of an advanced persistent threat (APS) attack. According to the MITRE ATT&CK framework, a complete attack chain typically includes stages such as initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, command and control, infiltration, and impact. All nodes in the attack chain are traversed, and attack stage labels are extracted from each node. The set of stages covered by the attack chain is counted. If the number of key attack stages covered by the attack chain reaches a stage coverage threshold, the stage coverage verification passes; otherwise, it is marked as an incomplete attack chain. The timing constraints between nodes in the attack chain are verified. Adjacent node pairs in the attack chain are traversed, and the timestamps of the preceding and following nodes are extracted. It is checked whether the timestamp of the following node is later than that of the preceding node. If there are node pairs with reversed timestamps, the attack chain violates the timing constraints and is marked as an invalid attack chain. If all adjacent node pairs satisfy the timing constraints, the timing verification passes. To verify the structural similarity between attack chain paths and known attack patterns, graph structures of known attack patterns are extracted from the threat intelligence knowledge base. The attack pattern graph contains nodes in typical attack stages and transition edges between nodes. The attack chain path is constructed as a subgraph, where nodes are nodes in the attack chain and edges represent temporal and causal relationships between nodes. The graph edit distance algorithm is used to calculate the similarity between the attack chain subgraph and the known attack pattern graph. The graph edit distance metric measures the minimum number of edit operations required to transform one graph into another. Edit operations include node insertion, node deletion, node replacement, edge insertion, and edge deletion. The graph edit distance is normalized to a similarity score between zero and one. If the similarity score exceeds the pattern similarity threshold, the attack chain passes the pattern similarity verification.

[0042] Threat level is calculated for attack chains that pass integrity verification. Threat level assessment considers multiple factors. First, an attack chain length factor is calculated, where the attack chain length is the number of nodes in the chain. A longer chain indicates a deeper attack and a greater threat. The length factor is normalized using a logarithmic function. Next, a node count factor is calculated, which counts the number of different asset nodes involved in the attack chain. More nodes indicate a wider attack scope and a greater threat. The node count factor is normalized to the zero-to-one range. Then, an attack phase coverage integrity factor is calculated, which equals the number of attack phases covered by the attack chain divided by the total number of critical attack phases. More complete coverage indicates a higher threat. Finally, an importance factor involving sensitive assets is calculated. Importance weights are pre-assigned to asset nodes within the enterprise intranet. Sensitive assets such as core servers, databases, and domain controllers have high weights, while ordinary workstations have low weights. The importance weights of each asset node in the attack chain are extracted, and the maximum weight is used as the importance factor. Finally, an attack success probability factor is calculated. Based on the anomaly score and correlation score of nodes in the attack chain, the probability of attack success is estimated. High node anomaly and strong correlation indicate a high probability of attack success. The comprehensive threat level score is calculated by weighted linear combination of factors such as attack chain length, number of nodes, phase coverage integrity, sensitive asset importance, and attack success probability. The weighting coefficients are determined based on security expert experience and analysis of historical attack cases. The comprehensive threat level score is normalized to a range of 0 to 100. Threat levels are classified according to the score range. A score above the lower threshold of high risk is classified as high risk, indicating that the attack has penetrated the core of the internal network and requires immediate response. A score between the lower threshold of medium risk and the lower threshold of high risk is classified as medium risk, indicating that the attack is ongoing and requires close monitoring. A score below the lower threshold of medium risk is classified as low risk, indicating a suspected attack or an early stage of an attack and requiring further verification.

[0043] The system generates a structured report on the identification of collaborative attacks. The report comprises several parts. The first part is a graphical visualization of the attack chain, using a directed graph to represent the attack chain path. Nodes represent assets or behaviors, node labels display node identifiers and attack stages, edges represent relationships between nodes, edge labels display time intervals and relationship types, and node colors are rendered based on anomaly scores, with nodes showing higher anomalies appearing darker. The second part is a list of nodes involved in the attack chain, displayed in a table format. Table columns include node identifier, node type, IP address, first activity time, latest activity time, anomaly score, and threat tag. The third part provides a detailed description of each attack stage, listing the stages of the attack chain chronologically. Each stage describes the nodes involved, the behaviors performed, the corresponding MITRE ATT&CK technical ID, and technical specifications. The fourth part presents the threat level assessment results, displaying the overall threat level score, level classification, and specific values ​​for each factor. The fifth part provides recommended emergency response measures, offering specific suggestions based on the characteristics and threat level of the attack chain, such as isolating affected nodes, blocking suspicious communications, resetting compromised credentials, and strengthening protection strategies.

[0044] The identification results are fed back into the dynamic knowledge graph. Update operations are performed on the nodes in the attack chain. This involves traversing all nodes in the attack chain path, locating the corresponding node object in the knowledge graph, updating the node's threat tag attribute (setting the tag value to "confirmed attack node"), updating the node's threat type attribute to "cooperative attack," updating the node's attack phase attribute to the identified MITRE ATT&CK phase, and updating the node's confidence attribute to "high confidence." Weight enhancement is performed on the edges between nodes in the attack chain. Adjacent node pairs are traversed, and the edges connecting the two nodes are located in the knowledge graph. The initial weights are multiplied by an enhancement factor greater than one to strengthen the confirmed attack relationship, and the edges are marked as confirmed attack relationship edges. Newly identified attack patterns are added to the threat intelligence knowledge base. Structural features of the attack chain are extracted, including node type sequences, attack phase sequences, and key behavior sequences. New attack pattern nodes are created, with attributes including pattern name, structural features, first discovery time, and associated attack organization. These attack pattern nodes are added to the base layer threat intelligence knowledge base, and instance relationship edges are established between the attack pattern nodes and key nodes in the attack chain.

[0045] Training samples are constructed using the feedback identification results. Incremental training is performed on the residual graph attention network and reinforcement learning model. Confirmed attack nodes are extracted from the identification report, and these nodes and their neighboring nodes are extracted from the knowledge graph as subgraphs. Attack nodes are labeled as positive samples with a label of one, and nodes not identified as attacks in the subgraphs are labeled as negative samples with a label of zero, thus constructing a training dataset for the node classification task. This training dataset is input into the residual graph attention network, which is trained using supervised learning. A cross-entropy loss function is defined, measuring the difference between the network's predicted node label probabilities and the true labels. Gradient descent optimization is used to update the network parameters and minimize the loss function. An incremental training strategy is employed, continuing training based on the existing network parameters to avoid forgetting previously learned knowledge. Simultaneously, state transition samples from the confirmed attack chain paths are added to the reinforcement learning experience replay buffer. Batch samples are sampled from the buffer to train a deep Q-network, updating the Q-network parameters and optimizing the attack chain inference strategy. The final collaborative attack identification report is output in a structured document format, containing the five parts mentioned above. The updated dynamic knowledge graph is also output, with the threat attributes of nodes and edges in the graph updated and the threat intelligence knowledge base expanded. The optimized detection model is output, including the parameters of the trained residual graph attention network model and the parameters of the deep Q-network model. The model is used for subsequent collaborative attack identification tasks. As feedback data accumulates, the model performance continues to improve, forming a continuous learning mechanism.

[0046] The method of this invention was deployed in the intranet environment of a large power group. This intranet comprises five network zones: an office zone, a production control zone, a data acquisition zone, an operations and maintenance management zone, and a boundary DMZ zone, containing a total of 1,200 hosts and industrial control devices. A boundary firewall, an intrusion detection system, and an endpoint security management system were deployed. During a seven-day monitoring period, the system collected multi-source security data, constructing a dynamic knowledge graph containing 1,200 asset nodes, over 150,000 behavioral nodes, and over 500,000 related edges. The cross-time window related edges effectively connected attack behavior fragments scattered across different monitoring days.

[0047] The system identified a cluster of fifteen coordinated attack nodes. The deduced attack chain path included seven attack stages: initial access, execution, persistence, privilege escalation, lateral movement, data collection, and infiltration. The threat level was assessed as high-risk. Manual verification confirmed that the attack chain was a genuine advanced persistent threat (APS) attack. The attacker compromised an engineer's workstation in the office area via phishing emails, then laterally moved to the operations and maintenance management area, escalated privileges, and infiltrated the data acquisition server in the production control area, stealing power grid dispatch-related production operation data.

[0048] The initial monitoring data obtained is shown in Table 1: Table 1, Example of Monitoring Data

[0049] The key nodes involved in the identified attack chain are shown in Table 2: Table 2, Key Nodes in the Attack Chain

[0050] This invention successfully identified a covert multi-node coordinated attack. Compared to traditional single-point detection methods, this method can correlate and analyze attack behaviors scattered across five network regions over a seven-day period. The cross-time window behavior pattern aggregation mechanism effectively connects the attacker's phased penetration behaviors implemented on different dates, allowing low-frequency behaviors that would not trigger thresholds in single-day monitoring to form a complete attack path in the graph. The graph autoencoder, based on the graph structure context, calculates the reconstruction error anomaly degree, accurately reflecting the moderate anomaly characteristics of the initial entry node due to disguised normal operation and maintenance behavior, forming a differential distribution consistent with the attack evolution pattern between it and the high anomaly characteristics of the end data-stealing nodes. The attack chain starting point selection strategy locates the initial entry engineer workstation communicating with a known malicious C2 server through threat association edges, accurately reconstructing the complete attack chain path and providing the security team with precise threat intelligence and incident response guidance.

[0051] The embodiments of the present invention have been described above. However, the embodiments are not limited to the specific implementation methods described above. The specific implementation methods described above are merely illustrative and not restrictive. Those skilled in the art can make more equivalent embodiments under the guidance of the present embodiments, and all of them are within the protection scope of the present embodiments.

Claims

1. A method for identifying multi-node collaborative attacks based on knowledge graphs, characterized in that, Includes the following steps: S1: Collect multi-source security data, and obtain behavioral event sequences through data cleaning, timestamp alignment, and feature extraction and transformation; S2, obtain the sequence of behavioral events, and through incremental construction of a two-layer graph, real-time matching and association of threat intelligence, and aggregation of cross-time window behavioral patterns, obtain a dynamic knowledge graph carrying threat attributes and time decay weights; S3, based on dynamic knowledge graph, extracts topological features through heterogeneous graph embedding, encodes temporal features through bidirectional long short-term memory network, fuses heterogeneous features through cross-modal attention, and calculates the reconstruction error anomaly degree through graph autoencoder, thereby obtaining the multimodal anomaly feature representation of the node; S4, receive a dynamic knowledge graph with multimodal anomaly feature representation, identify attack node clusters through a residual graph attention network with temporal causal constraints and co-correlation analysis, and use reinforcement learning to infer attack chains to obtain co-attack node clusters and attack chain paths. S5, based on the cluster of collaborative attack nodes and the attack chain path, obtains a collaborative attack identification report and an optimized detection model through attack chain integrity verification, threat level assessment, identification report generation, and feedback update of the knowledge graph.

2. The method for identifying multi-node collaborative attacks based on knowledge graphs according to claim 1, characterized in that, S1 includes: Data cleaning is performed on the collected multi-source heterogeneous data. Duplicate records are identified and deleted by comparing hash values ​​based on the combination of key fields of the records. Records missing source IP address, target IP address or timestamp are marked as invalid records and removed. For records with missing timestamps but complete timestamps of adjacent records, a linear interpolation method is used to take the average of the timestamps of the preceding and following records as the complete value; All timestamps are uniformly converted to the UTC standard time format, and the clocks of each data source device are synchronized through the network time protocol. The clock deviation is corrected according to the time difference between the device and the standard time server to achieve alignment.

3. The method for identifying multi-node collaborative attacks based on knowledge graphs according to claim 1, characterized in that, S2 includes: Initialize a two-layer knowledge graph structure. The base layer loads a pre-built threat intelligence knowledge base, which includes malicious IP nodes, attack pattern nodes, and vulnerability nodes and their associated edges. The dynamic layer is initialized as an empty graph structure. The behavior event sequence is processed one by one using a streaming processing method. The source entity and target entity are queried to see if the corresponding node already exists. If not, the asset node or behavior node is created and added to the hash index. If it already exists, the latest activity timestamp and cumulative behavior count are updated. The newly added asset nodes in the dynamic layer are matched with the malicious IP nodes in the basic layer. If the match is successful, a threat association edge is established and the threat tag attribute of the node is marked. The behavior node and the attack pattern node are matched for sequence similarity based on a combination of the longest common subsequence and the edit distance. If the similarity exceeds the preset pattern matching threshold, a pattern association edge is established.

4. The method for identifying multi-node collaborative attacks based on knowledge graphs according to claim 1, characterized in that, S2 further includes: The entire monitoring period is divided into multiple time windows with a fixed step size. An overlapping interval is set between adjacent time windows. For the behavior event sequence of each asset node in each time window, a set of behavior segments consisting of N consecutive behavior types is extracted in an N-gram manner. Each segment is mapped to an integer hash value to form a behavior pattern fingerprint vector. Locality-Sensitive Hash (LSH) algorithm is used to map fingerprint vectors to low-dimensional hash buckets to quickly retrieve candidate similar behavior pattern pairs. Jaccard similarity is calculated for candidate pairs. If the similarity exceeds a preset cross-window threshold, cross-time window association edges are established between the corresponding behavior nodes. A time decay weight mechanism is introduced for all edges in the dynamic knowledge graph. The current weight of an edge is equal to the initial weight multiplied by an exponential decay factor calculated based on the time difference between the edge's latest activity timestamp and the current system time. All edges are traversed periodically, and edges with a current weight lower than a preset pruning weight threshold are removed. Isolated nodes with a degree of zero and a latest activity timestamp exceeding a preset node retention period threshold are also removed.

5. The method for identifying multi-node collaborative attacks based on knowledge graphs according to claim 1, characterized in that, S3 includes: The dynamic knowledge graph is embedded using a heterogeneous graph embedding algorithm based on meta-paths, and multiple meta-path patterns are defined, including asset node to asset node via behavior node, asset node to threat intelligence node via behavior node, behavior node to behavior node via temporal edge, and asset node to behavior node of another time window via cross-time window association edge. Random walks are performed on the knowledge graph based on meta-paths. The selection probability of neighboring nodes is proportional to the current weight of the edge. A heterogeneous Skip-Gram model is used to learn the vector representation of nodes through negative sampling techniques to obtain the graph embedding vector. For each asset node, extract the temporal behavior sequence within a specified time window, encode the type and attributes of the behavior events into an initial feature vector, input it into a bidirectional long short-term memory network, and concatenate the forward and backward final hidden states to obtain the encoding vector of the behavior sequence.

6. The method for identifying multi-node collaborative attacks based on knowledge graphs according to claim 1, characterized in that, S3 further includes: The cross-modal attention fusion module is designed to map the graph embedding vector of the asset node to the query vector through linear transformation, and to map the bidirectional hidden state sequence of the behavior sequence to the key vector sequence and the value vector sequence respectively. Attention scores are calculated by scaling the dot product and then normalized by softmax to obtain attention weights. The value vector sequence is weighted and aggregated according to the attention weights to obtain the aligned temporal feature vector. The graph embedding vector and the aligned temporal feature vector are concatenated and then passed through a fully connected layer and a sigmoid activation function to obtain the fusion gate output. The fusion feature vector is equal to the graph embedding vector multiplied by the fusion gate weight, plus the aligned temporal feature vector multiplied by one minus the fusion gate weight, and then passed through a ReLU activation function to obtain the multimodal feature vector. After the multimodal feature vectors of all nodes are calculated, they are batch input into the graph autoencoder. The encoder uses a graph convolutional network to weighted aggregate the features of the target node and the features of its neighboring nodes and map them to a low-dimensional latent representation space. The decoder maps the low-dimensional latent representation back to the original dimension. The mean squared error is minimized by training with normal behavior node data. During the inference stage, the reconstruction error of each node is calculated as an anomaly score, which is combined with the multimodal feature vectors to form the multimodal anomaly feature representation.

7. The method for identifying multi-node collaborative attacks based on knowledge graphs according to claim 1, characterized in that, S4 includes: A multi-layer residual graph attention network is constructed. The initial feature vector of the node is the multimodal anomaly feature representation. In each layer, the source nodes are grouped according to the incoming edge type for each target node. For each edge type, the feature vectors of the target node and the source node are concatenated and the attention logit value is calculated by the type-specific attention weight matrix and the LeakyReLU activation function. The attention weight is obtained by softmax normalization. The source node features are weighted and aggregated according to the attention weight. A multi-head attention mechanism is used to fuse the aggregated vectors of different edge types to obtain a comprehensive neighbor information representation vector. The target node feature vector input to the current layer is added to the comprehensive neighbor information representation vector to achieve residual connection. After layer normalization, the updated node feature vector is output. During the information aggregation process, the timestamp attributes of the source node and the target node are checked for each edge. If the latest activity timestamp of the source node is later than the latest activity timestamp of the target node, a time-series mask matrix with a mask value of negative infinity is generated. The time-series mask matrix is ​​added to the attention logit value. After softmax normalization, the attention weight of the source node that violates the time-series constraint approaches zero.

8. The method for identifying multi-node collaborative attacks based on knowledge graphs according to claim 1, characterized in that, S4 further includes: After passing through a multi-layer residual graph attention network, the final feature representation of all nodes is extracted. For any pair of nodes, the cosine similarity of the final feature vector is calculated as the feature similarity score. The reciprocal of the shortest path length between two nodes is calculated as the topological proximity score. The number of behavioral events that two nodes jointly participate in within a specified time window is counted as the behavioral association frequency. The comprehensive collaborative association score is calculated by weighted summation of feature similarity score, topological proximity score, and behavioral association frequency. The weight coefficients are obtained by training on the validation set data. A node association graph is constructed, with nodes whose collaborative association scores exceed a preset collaborative association threshold as edges. The Louvain community detection algorithm is used to identify node communities through modularity optimization. Each community corresponds to a potential cluster of collaborative attack nodes.

9. The method for identifying multi-node collaborative attacks based on knowledge graphs according to claim 1, characterized in that, S4 further includes: For each cluster of collaborative attack nodes, the node with the earliest time of the first abnormal activity and the existence of a threat-related edge is selected as the starting point of the attack chain. If there is no node with a threat-related edge, the node with the earliest timestamp of the first abnormal activity is selected as the starting point. The attack chain reasoning is modeled as a Markov decision process, with the state space being the current attack chain path and the set of candidate expansion nodes, and the action space being the selection of candidate nodes to join the attack chain or to terminate the reasoning. The reward function comprehensively considers the collaborative correlation score between the newly added node and the current end node of the chain, the rationality of the attack phase transition, and the path length penalty. A deep Q-network is constructed to learn the optimal inference strategy. The network is trained using experience replay and target network mechanisms. Starting from the starting node, the action with the largest Q value is selected step by step to expand the attack chain until the inference is terminated, the candidate node set is empty, or the preset maximum path length threshold is reached. The nodes in the attack chain path obtained by inference are sorted in chronological order and labeled with the corresponding MITREATT&CK attack stage.

10. The method for identifying multi-node collaborative attacks based on knowledge graphs according to claim 1, characterized in that, S5 includes: For each attack chain path, verify whether the number of attack stages it covers reaches the preset stage coverage threshold, verify whether the timestamps of adjacent nodes meet the temporal constraints, and use the graph editing distance algorithm to calculate whether the similarity between the attack chain subgraph and the known attack pattern graph exceeds the preset pattern similarity threshold. For verified attack chains, the attack chain length factor, node number factor, phase coverage integrity factor, sensitive asset importance factor, and attack success probability factor are combined in a weighted linear combination to calculate a comprehensive threat level score, and the threat level is divided according to the score range. The threat labels of nodes in the attack chain are updated to confirmed attack nodes. The initial weights of the edges in the attack chain are multiplied by an enhancement factor to enhance the weights. Newly identified attack patterns are added to the threat intelligence knowledge base. Training samples are constructed using confirmed attack nodes to incrementally train the residual graph attention network and the deep Q network.

Images