A host threat detection method and system based on multi-source heterogeneous data pre-training

Abstract

The application provides a host threat detection method and system based on multi-source heterogeneous data pre-training, relates to the technical field of network security threat detection, and constructs a heterogeneous graph containing multiple node types and edge types, associates and models data of different modes in a unified graph structure; then, a multi-task self-supervised pre-training strategy is performed on the heterogeneous graph, so that the graph neural network learns a general deep representation of host behavior without relying on attack labels; finally, threat evaluation is performed on the behavior edge based on the pre-trained model, and fine threat judgment is realized by using edge time sequence context coding and dynamic feature fusion, so that the problems of low fusion degree of multi-source heterogeneous data, ineffective use of multi-source information in the pre-training stage and lack of dynamic context in edge-level evaluation in the prior art can be solved, and the technical effects of improving the accuracy and generalization ability of host threat detection, reducing the false positive rate and improving the precision and recall rate are achieved.

Description

Technical Field

[0001] This application relates to the field of network security threat detection technology, and in particular to a host threat detection method and system based on multi-source heterogeneous data pre-training. Background Technology

[0002] With the rapid development of network technology, information systems are increasingly widely used in various critical scenarios, and network attack methods are showing a trend towards intelligence, diversification, and concealment. Traditional signature-based detection methods rely on known attack characteristics, making it difficult to deal with unknown attacks and their variants, and gradually failing to meet actual security needs. Therefore, machine learning-based host threat detection methods have gradually become a research hotspot.

[0003] In existing technologies, data source graphs are typically constructed based on host logs, network traffic, and other data. Entities such as processes, files, and network connections are used as nodes, and system events are used as edges. Graph neural networks are then combined to model host behavior and detect anomalies. The graph structure can depict the relationships between system entities, thereby improving the ability to identify complex attack behaviors.

[0004] For example, Chinese patent document CN121711121A discloses an intelligent attack detection method based on multi-source data fusion. This method collects network traffic data, host log data, and user behavior data through distributed probes to construct a multi-source heterogeneous dataset. It further generates high-dimensional feature vectors through feature engineering and inputs them into a pre-trained hybrid detection model for attack identification. The hybrid detection model includes a real-time detection sub-model based on Transformer and a correlation analysis sub-model based on graph neural network. At the same time, it combines reinforcement learning methods to achieve adaptive blocking decisions and feedback optimization.

[0005] While graph neural network-based host threat detection methods can improve the identification of complex attack behaviors to some extent, they still have significant shortcomings. First, multi-source heterogeneous data differ greatly in data structure, semantic representation, and time scale. Existing technologies typically use simple concatenation or parallel input methods, lacking modeling of the inherent relationships between different data modalities, resulting in low data fusion and difficulty in fully leveraging the synergistic advantages of multi-source data. Second, during model training, some methods rely primarily on a single data source in the pre-training stage, failing to comprehensively utilize information from multiple sources, leading to limited model learning capabilities and insufficient adaptability to complex attack scenarios. Furthermore, existing methods, when constructing graph structures, often focus on modeling single-type behavioral data, failing to adequately depict cross-data source interactions, thus limiting the ability to identify attack paths and covert behaviors.

[0006] Taking existing patent solutions as an example, although they introduce multi-source data and combine them with graph neural networks for analysis, they still mainly rely on simple combinations at the feature level in the process of multi-source heterogeneous data fusion, lacking a unified and effective correlation modeling mechanism, making it difficult to achieve the mining of deep semantic information. These problems, to some extent, restrict the accuracy and generalization ability of host threat detection.

[0007] Therefore, how to construct effective correlation modeling methods for multi-source heterogeneous data, improve the degree of fusion between different data modalities, and enhance the model's ability to represent complex attack behaviors has become a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0008] This application aims to at least partially address one of the technical problems in the related art.

[0009] To address the problems of low fusion levels of multi-source heterogeneous data, insufficient modeling of relationships between different data modalities, and ineffective utilization of multi-source information in the pre-training process in existing technologies, this application aims to provide a graph neural network-based host threat detection method based on multi-source heterogeneous data. By introducing a pre-training mechanism oriented towards multi-source data, host log data and network traffic data are jointly modeled in a unified graph structure, enhancing the ability to represent relationships between different data modalities, thereby improving the fusion effect of multi-source data and ultimately increasing the accuracy and generalization ability of host threat detection.

[0010] Another aspect of this application proposes a host threat detection system based on graph neural networks with multi-source heterogeneous data.

[0011] To achieve the above objectives, the first aspect of this application proposes a host threat detection method based on multi-source heterogeneous data pre-training, comprising: Acquire multi-source heterogeneous host behavior data; A heterogeneous graph is constructed based on the host behavior data; wherein, nodes in the heterogeneous graph represent host entities, and edges represent interaction behaviors between entities; A pre-trained model is obtained by training a graph neural network using a multi-task self-supervised pre-training strategy. Threat assessment of behavioral edges in the heterogeneous graph is performed based on the pre-trained model to obtain detection results.

[0012] In one embodiment of this application, obtaining multi-source heterogeneous host behavior data includes: Collect system call logs and network traffic data from heterogeneous operating systems; The collected logs and data are timestamped and formatted to obtain a standardized sequence of behavioral records.

[0013] In one embodiment of this application, constructing a heterogeneous graph based on the behavioral data includes: Extract processes, files, and network sockets as node types from the host behavior data, and extract process creation, file reading and writing, and network connection as edge types; Based on the temporal relationships between entities, a heterogeneous graph with different node and edge types is constructed.

[0014] In one embodiment of this application, training the graph neural network using a multi-task self-supervised pre-training strategy includes: Design a first self-supervised pre-training task and a second self-supervised pre-training task. The first self-supervised pre-training task is node attribute mask reconstruction, and the second self-supervised pre-training task is edge existence prediction. Based on the heterogeneous graph, a first self-supervised pre-training task and a second self-supervised pre-training task are jointly performed to pre-train the graph neural network.

[0015] In one embodiment of this application, the node attribute mask reconstruction task includes: Randomly mask the attribute vectors of some nodes in a heterogeneous graph; Graph neural networks are used to predict the attribute vectors of masked nodes based on the attributes of unmasked nodes and the graph structure. The parameters of the graph neural network are updated by minimizing the difference between the predicted attribute vector and the true attribute vector.

[0016] In one embodiment of this application, obtaining the pre-trained model includes: The heterogeneous graph is augmented to generate at least one augmented view; Based on the heterogeneous graph and the enhanced view, the mutual information between node representations is maximized through a contrastive learning task. The graph neural network parameters are updated based on contrastive learning loss.

[0017] In one embodiment of this application, the threat assessment of behavioral edges in the heterogeneous graph based on the pre-trained model to obtain detection results includes: The pre-trained model is used to perform forward propagation on each behavioral edge in the heterogeneous graph to obtain the embedding representation of the edge; The embedded representation is input into the anomaly detector to obtain a threat score; Compare the threat score with a preset threat score threshold to identify threat edges and output the detection results.

[0018] In one embodiment of this application, the edge existence prediction task includes: Randomly delete some edges in the heterogeneous graph; Predicting the existence of deleted edges using graph neural networks; The graph neural network parameters are updated by minimizing the cross-entropy loss between predicted edge existence and actual edge existence.

[0019] Furthermore, to implement the above embodiments, this application proposes a host threat detection system based on multi-source heterogeneous data pre-training, comprising: The acquisition module is used to acquire multi-source heterogeneous host behavior data; A graph construction module is used to construct a heterogeneous graph based on the host behavior data; wherein, nodes in the heterogeneous graph represent host entities, and edges represent interaction behaviors between entities; The pre-training module is used to train the graph neural network using a multi-task self-supervised pre-training strategy to obtain a pre-trained model. The detection module is used to perform threat assessment on the behavioral edges in the heterogeneous graph based on the pre-trained model and obtain the detection results.

[0020] The methods and systems of this application address the problems in the prior art, such as low fusion of multi-source heterogeneous data, failure to effectively utilize multi-source information in the pre-training stage, and lack of dynamic context in edge-level evaluation. They achieve the technical effects of improving the accuracy and generalization ability of host threat detection, reducing false positive rate, and improving precision and recall rate.

[0021] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0022] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 A flowchart illustrating a host threat detection method based on multi-source heterogeneous data pre-training, provided in this application embodiment; Figure 2 A logical schematic diagram of a host threat detection method based on multi-source heterogeneous data pre-training provided in an embodiment of this application; Figure 3 This is a structural diagram of a host threat detection system based on multi-source heterogeneous data pre-training, provided in an embodiment of this application. Detailed Implementation

[0023] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0024] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0025] The following description, with reference to the accompanying drawings, describes a host threat detection method and system based on multi-source heterogeneous data pre-training, according to embodiments of this application.

[0026] Example 1 like Figure 1 As shown, this host threat detection method based on multi-source heterogeneous data pre-training specifically includes the following steps: Step 101: Obtain multi-source heterogeneous host behavior data.

[0027] In this embodiment, various types of raw logs are collected from the host operating system and network devices, including system audit logs (such as records of process creation, file access, registry operations, thread scheduling, etc.) and network traffic logs (such as records of network connection establishment and data stream transmission). These logs come from different sources and have different formats, representing multi-source heterogeneous data. First, the raw logs are uniformly cleaned and parsed to remove duplicate records, abnormal fields, and invalid entries, and key fields are extracted, including timestamps, subject objects (such as process IDs and user accounts), object objects (such as file paths, IP addresses, and port numbers), actions, and related attributes. Next, log standardization and time alignment are performed: all log timestamps are uniformly converted to UTC time format, and missing timestamps are filled using linear interpolation of preceding and following valid times or by using neighboring values ​​to ensure the temporal continuity of the event sequence.

[0028] Feature extraction and representation are then performed. Different subjects and objects are mapped to candidate node identifiers, and actions are mapped to candidate edge types, forming the skeleton of the graph structure. For textual attributes (such as file paths, command-line arguments, and domain names), a pre-trained sentence embedding model, SentenceTransformer (e.g., all-MiniLM-L6-v2), is used for semantic encoding to obtain fixed-dimensional high-dimensional vectors, which serve as the textual features of the nodes. For numerical attributes (such as operation frequency, data size, and connection duration), a log1p logarithmic transformation is applied to compress the long-tailed distribution, and the statistical maxima of the entire dataset are stored for use in the subsequent Min-Max normalization stage during pre-training.

[0029] Finally, the processed data is organized into standardized behavior records. Each record contains at least the following fields: source node identifier, target node identifier, edge type, timestamp, structured feature vector, and text feature vector. The output is standardized host behavior data for use in subsequent heterogeneous graph construction steps.

[0030] Step 102: Construct a heterogeneous graph based on the behavioral data, wherein nodes in the heterogeneous graph represent host entities and edges represent interaction behaviors between entities.

[0031] In this embodiment, a heterogeneous graph is constructed based on the obtained normalized host behavior data. First, node types are determined: host entities are extracted from the normalized system audit logs, including local entities such as processes, files, registry entries, and threads, and external network entities such as remote IP addresses and remote ports, defined as "local nodes" and "remote nodes," respectively. A node is created for each unique entity, and a type identifier is assigned to the node. For node attributes, multi-source feature fusion is used: structural features such as process IDs and file paths are directly used as node identifiers; for path-type text attributes, a pre-trained SentenceTransformer model (e.g., all-MiniLM-L6-v2) is used for semantic encoding to obtain high-dimensional semantic vectors to capture semantic relationships between texts; for numerical features such as frequency and magnitude, a log1p transformation is first performed, followed by Min-Max normalization using statistical maxima calculated on the same source dataset during the pre-training phase, thereby mitigating the bias in numerical distribution under different host environments.

[0032] Subsequently, edge types were determined: based on the source and interaction nature of the behavioral data, interactions between entities were divided into two categories: operations between entities within the host (such as process creation and file reading / writing) were mapped to "host-internal interaction" edges; behaviors involving network communication (such as network connection) were mapped to "network flow" edges. Each edge connects a source node and a target node, and records attributes such as action type and occurrence timestamp. While constructing the graph structure, a list of adjacent edges arranged in descending temporal order was built for each node. That is, for each node, all its adjacent edges were collected and sorted from newest to oldest according to the timestamp of the corresponding behavior, forming a historical behavior sequence index. This generates a heterogeneous source graph containing two node types and two edge types. Each node has a fused feature vector, and each edge contains source / target node indexes, edge type, timestamp, and other information, along with a temporally sorted adjacent index, providing a structured and temporally ordered data foundation for subsequent message passing and context encoding in the graph neural network.

[0033] Step 103: Train the graph neural network using a multi-task self-supervised pre-training strategy to obtain a pre-trained model.

[0034] In this embodiment of the application, this step, based on the constructed heterogeneous graph, designs and jointly optimizes three complementary self-supervised pre-training tasks, enabling the graph neural network to learn a general deep representation of host behavior without relying on attack labels.

[0035] First, a node attribute masking autoencoder task is performed. A subset of nodes in the heterogeneous graph is randomly masked. This fusion feature is obtained by concatenating standardized numerical features and text semantic vectors through a linear layer and ReLU activation, followed by node type identifiers. A spatiotemporal heterogeneous graph convolutional layer (such as HEATConv) is used to message-pass the masked graph to obtain node embeddings, and a reconstruction network is used to recover the original masked features. The loss function for this task uses mean squared error (MSE), forcing the model to learn the global distribution and local contextual dependencies of node attributes.

[0036] Secondly, node behavior prediction is performed simultaneously. For each node, its adjacent edge sequence is extracted in chronological order to construct a preceding behavior sequence, which is then input into a temporal context encoder. The encoder uses a self-attention mechanism with a time-interval gating function to perform time-sensitive weighting on historical events, outputting a temporal context vector. Subsequently, a prediction head predicts the next behavior type (such as file read / write, network connection, etc.) and related attributes (such as port, protocol) based on this context vector. The loss for this task uses cross-entropy loss to enhance the model's ability to model the logic of behavior evolution.

[0037] Simultaneously, a cross-modal masked edge modeling task is performed. A portion of edges and their context are randomly masked. An edge context encoder is used to retrieve the historical event sequences of the source and destination nodes before the edge occurrence time. A shared sequence encoder generates contextual representations of the source and destination ends, and asymmetric cross-attention is used to fuse them, resulting in a contextual semantic representation of the masked edge. Finally, combining the edge type information, a prediction head reconstructs the attributes of the masked edge (such as action type, data volume, etc.). The loss for this task is also cross-entropy, forcing the model to learn the cross-modal correlation between structural information and behavioral temporal information.

[0038] Finally, a temporal adjacency node-edge contrastive learning task is executed. This task directly shapes the edge context representation consumed by the downstream detector using a contrastive learning paradigm, making the unlabeled pre-trained representation space more discriminative. The specific design is as follows: First, anchor edge sampling is performed: a batch of edges with source nodes of type process (LOCAL_NODE) ​​are randomly selected from the graph as anchor edges, because processes are the main entities initiating behavior, and their historical behavior sequences have the richest semantics. Then, positive sample construction is performed: for each anchor edge e_a (source node u), the nearest K_lookup preceding edges are retrieved from u's temporally descending adjacency edge list (CSR index). One preceding edge is uniformly sampled as a positive sample e_p from the preceding edges that meet the following three conditions: first, the destination node type is the same as the destination node type of e_a; second, the time interval between e_a and the target node is less than the time_window; third, it is not e_a itself. This strategy implies that the behavior of the same process towards similar target entities within a short time window should have a consistent representational prior. Next, disjoint negative samples are constructed: the remaining anchor edges within the batch are used as negative samples, but sample pairs sharing arbitrary endpoints with anchor edges are eliminated through disjoint masking to avoid misclassifying semantically similar real positive samples as negative samples. Then, the symmetric InfoNCE loss is calculated: after the anchor edges and positive sample edges are encoded into edge representations by the edge context encoder, they are mapped to the contrast space by an L2-normalized projection head (Contrastive Projector, outputting 64 dimensions), and the symmetric InfoNCE loss is calculated using a temperature coefficient τ. This projection head is only used in the pre-training phase and discarded during fine-tuning, but its gradient backpropagation updates the edge context encoder, thereby directly optimizing the representation path relied upon by the downstream detector. Furthermore, this task employs a pre-warming scheduling strategy: several rounds of training are performed on the aforementioned node attribute mask autoencoder, node behavior prediction, and cross-modal mask edge modeling tasks. The contrastive loss is then enabled after the backbone representation stabilizes, and its participation in joint optimization is controlled by the weight coefficient lambda_tanc, avoiding the disruption of early convergence by contrastive learning during the representation formation stage.

[0039] The losses for the four tasks are weighted and summed during the pre-training phase, with weight coefficients of 0.4, 0.3, 0.2, and 0.1, and jointly optimized using the Adam optimizer with an initial learning rate of 0.001. The pre-training process involves multiple rounds of training on graph data containing only benign logs until convergence, ultimately yielding a pre-trained graph neural network model. This model can quickly adapt to supervised threat detection tasks during fine-tuning.

[0040] Step 104: Based on the pre-trained model, perform threat assessment on the behavioral edges in the heterogeneous graph to obtain detection results.

[0041] In this embodiment, this step is executed in the actual deployed host threat detection process. The pre-trained model can be used directly for inference, or model parameters adapted to a specific detection scenario can be obtained through a fine-tuning phase before inference. A typical edge-level threat assessment process is as follows: First, the optimal model parameters, after supervised fine-tuning, are loaded. The backbone network inherits weights from the graph neural network obtained through multi-task self-supervised pre-training, and the edge context encoding module and binary classification detection head weights trained during the fine-tuning phase are also loaded. Depending on the deployment environment requirements, a threshold configuration file can also be loaded. The threshold can be the optimal threshold selected on the validation set, or a fixed threshold set based on the target alarm rate.

[0042] Next, the heterogeneous graph to be detected is input. This heterogeneous graph can be organized by host or time window, and the nodes and edges in the graph maintain the same structure and feature representation as in the pre-training stage. For example, nodes contain standardized numerical features and text semantic vectors, and edges contain type identifiers and temporal information. First, a full graph node forward propagation is performed, and the embedding representation of all nodes is calculated using a graph neural network (such as a spatiotemporal heterogeneous graph convolutional layer based on HEATConv). This calculation is performed only once to reduce the redundant overhead of subsequent edge-level evaluation.

[0043] Next, the edges to be tested are grouped into batches, and context reasoning is performed on each batch of edges. For each edge, the historical behavioral event sequence of its source and target nodes before the time of the edge occurrence is extracted from the heterogeneous graph, i.e., the preceding interaction edges of the source and target nodes respectively. These two event sequences are input into the temporal context encoder. During the encoding process, a time-sensitive weighting of historical events is applied using an exponential decay gating function based on time intervals, making the contribution of recent events greater while retaining the mild influence of distant but relevant events; then, an asymmetric cross-attention mechanism is used to fuse the temporal context of the source and target ends to generate the dynamic threat context representation of the edge. The obtained context representation is fused with the node pair representation (obtained by concatenating and projecting the source node embedding and the target node embedding) through a learnable gating mechanism to obtain the final edge representation h_edge.

[0044] Then, the edge representation is input into the binary classification detection head, and the output is the probability score (score∈[0,1)) of the edge being malicious behavior. Each batch of edges is processed sequentially to obtain the malicious probability of all edges to be tested.

[0045] Finally, threshold determination and alarm generation are performed. Based on a pre-set threshold `thr`, if `score ≥ thr`, the edge is determined to be a malicious edge, and a corresponding security alarm is generated; otherwise, it is determined to be normal behavior. Alarm information may include the corresponding source node, target node, edge type, occurrence time, and malicious score, for further analysis by security operations personnel. Through the above edge-level threat assessment process, the historical behavior context of nodes can be fully combined to perform refined threat judgment on each interaction, significantly reducing false positives and improving detection accuracy.

[0046] This application achieves a unified collection and standardization of multi-source heterogeneous host behavior data, constructing a heterogeneous graph containing various node and edge types. This allows for the association and modeling of data from different modalities within a unified graph structure. Furthermore, a multi-task self-supervised pre-training strategy is executed on this heterogeneous graph, enabling the graph neural network to learn a general deep representation of host behavior, including node attribute distribution, behavioral evolution logic, and cross-modal associations, without relying on attack labels. Finally, threat assessment is performed on behavioral edges based on the pre-trained model, utilizing temporal context encoding and dynamic feature fusion to achieve refined threat judgment. Therefore, this approach addresses the problems in existing technologies, such as low fusion levels of multi-source heterogeneous data, ineffective utilization of multi-source information during pre-training, and lack of dynamic context in edge-level assessment. This results in improved accuracy and generalization ability of host threat detection, reduced false positive rates, and enhanced precision and recall.

[0047] Based on the technical solutions described in the above embodiments, in order to enable those skilled in the art to more clearly understand the technical concept of this application and to ensure detailed and specific support for the protection scope of the dependent claims, the additional technical features will be further described in detail below in conjunction with specific embodiments. Furthermore, the host threat detection method based on multi-source heterogeneous data pre-training described above may also include the following embodiments: The host threat detection method based on multi-source heterogeneous data pre-training provided in this application includes: Step 201, obtaining multi-source heterogeneous host behavior data includes: collecting system call logs and network traffic data from heterogeneous operating systems; aligning the collected logs and data with timestamps and normalizing the format to obtain a standardized behavior record sequence.

[0048] Specifically, in step 201, system call logs and network traffic data from heterogeneous operating systems are collected. In this embodiment, a lightweight collection agent is deployed on the heterogeneous operating system hosts requiring monitoring, including Windows, Linux, and macOS. This collection agent uses a kernel event capture mechanism. On the Windows platform, it utilizes Event Tracing for Windows (ETW) or kernel callback functions to mount system call points such as process creation, thread injection, file access, and registry modification. On the Linux platform, it captures system call logs for process execution, file operations, and network socket creation based on Auditd, eBPF, or Ptrace frameworks. On the macOS platform, it collects process and file events using the Endpoint Security framework.

[0049] Meanwhile, the data acquisition agent utilizes the operating system's network packet capture interface, such as libpcap on Linux or WinPcap / Npcap on Windows, to capture the raw network traffic entering and leaving the host in full or by sampling, retaining a five-tuple of information including source IP, destination IP, source port, destination port, protocol type, and packet length. The collected system call logs and network traffic data are temporarily stored in a structured manner in a local memory buffer, awaiting further processing.

[0050] Step 202: Timestamp alignment and format normalization are performed on the collected logs and data to obtain a standardized sequence of behavior records.

[0051] Specifically, in step 202, since there may be discrepancies in the time sources between different hosts and between different log sources within the same host, this embodiment uses the Network Time Protocol (NTP) to periodically synchronize the time of all controlled hosts, ensuring that the system clock deviation of each collection agent is controlled within milliseconds. Each system call log and network traffic data packet is stamped with a high-precision timestamp by the collection agent when it is generated, and this timestamp is based on Coordinated Universal Time (UTC).

[0052] Subsequently, the acquisition agent or central preprocessing module merges and sorts all records by timestamp, forming a globally ordered record stream. Regarding format normalization, this embodiment defines a unified standardized record model to address the differences in log formats output by different operating systems. This model maps heterogeneous formats such as Windows event logs, Linux audit logs, and macOS unified logs to a common JSON structure. Each standardized record includes at least the following information fields: timestamp, host identifier, operating system type, behavior type (e.g., process creation, network connection, file write), process identifier, parent process identifier, file path, and network address. Network traffic data is also converted into standardized records containing timestamps, communication peer information, and packet summaries. Through the above timestamp alignment and format normalization processes, a standardized sequence of behavior records ordered by time and with consistent fields is finally obtained.

[0053] Step 301, the construction of a heterogeneous graph based on the behavioral data, wherein the nodes in the heterogeneous graph represent host entities and the edges represent the interaction behaviors between entities, includes: extracting processes, files, and network sockets as node types from the behavioral data, and extracting process creation, file reading and writing, and network connection as edge types; and constructing heterogeneous graphs with different node types and edge types based on the temporal correlation between the entities.

[0054] Specifically, in step 301, firstly, process entities, file entities, and network socket entities are identified and extracted as node types in the heterogeneous graph from the normalized host behavior data. Process entities are identified by their process unique identifier (PID) and program path; file entities are identified by their file path or inode; and network socket entities are identified by their IP address, port, and protocol triplet. Secondly, edge types are extracted based on the operation events between entities, including: directed edges from parent process nodes to child process nodes established by process creation events; directed edges from process nodes to file nodes established by file read / write events, with the direction of the edges marked according to whether they are read or written; and directed edges from process nodes to network socket byte nodes established by network connection events. Then, based on the timestamp information of each entity's interaction events, interaction events occurring within the same time period are associated using time correlation relationships. For example, using a preset time window (e.g., 5 minutes), all entities and edges falling within the same window are constructed into a snapshot of the heterogeneous graph, or a dynamic evolution graph is constructed using a sliding window. In this way, the resulting heterogeneous graph not only includes three node types—processes, files, and network sockets—but also three edge types—process creation, file reading / writing, and network connections—comprehensively characterizing the internal behavior and interactions of the host, providing structured input for subsequent security detection based on graph neural networks. This refined construction process clarifies the specific types of entities and edges and introduces temporal correlation constraints, enabling the heterogeneous graph to more accurately reflect attack patterns such as lateral movement and privilege escalation in attack behavior.

[0055] Step 401, the step of training the graph neural network using a multi-task self-supervised pre-training strategy to obtain a pre-trained model includes: designing a first self-supervised pre-training task and a second self-supervised pre-training task, wherein the first self-supervised pre-training task is node attribute mask reconstruction and the second self-supervised pre-training task is edge existence prediction; and jointly executing the first self-supervised pre-training task and the second self-supervised pre-training task based on the heterogeneous graph to pre-train the graph neural network.

[0056] Specifically, in step 401, the graph neural network is trained using a multi-task self-supervised pre-training strategy to obtain a pre-trained model, including: designing a first self-supervised pre-training task, a second self-supervised pre-training task, a third self-supervised pre-training task, and a fourth self-supervised pre-training task; the first self-supervised pre-training task is node attribute mask reconstruction, the second self-supervised pre-training task is edge existence prediction, the third self-supervised pre-training task is a cross-modal mask edge modeling task, and the fourth self-supervised pre-training task is a temporal adjacent node-edge comparison learning task, wherein the fourth self-supervised pre-training task specifically includes data augmentation of the heterogeneous graph to generate at least one augmented view.

[0057] Specifically, in step 401, corresponding to multi-task self-supervised pre-training, this embodiment designs four complementary pre-training tasks. The first task is node attribute mask reconstruction, which aims to enable the graph neural network to learn the high-level attribute representation of nodes; the second task is edge existence prediction, which aims to mine connection patterns in the graph structure; the third task is cross-modal masked edge modeling, which is used to mine cross-modal associations between structure and temporal behavior; the fourth task is to maximize the consistency of the representation of the same node and the same process temporal edge under different augmented views through contrastive learning. During training, the loss functions of these four tasks are combined in a weighted summation manner to jointly optimize the graph neural network parameters, so that the model can obtain rich self-supervised signals from four dimensions: node attributes, graph structure, cross-modal temporal associations, and cross-view robust representations.

[0058] Step 402, the node attribute masking reconstruction task, includes: randomly masking the attribute vectors of some nodes in the heterogeneous graph; using a graph neural network to predict the attribute vectors of the masked nodes based on the attributes of the unmasked nodes and the graph structure; and updating the parameters of the graph neural network by minimizing the difference between the predicted attribute vectors and the true attribute vectors. Specifically, in step 402, in each training iteration, the node attribute matrix of the input heterogeneous graph is randomly masked, for example, by randomly selecting about 15% of the nodes and setting their original attribute vectors to all zeros or noise vectors. Subsequently, the heterogeneous graph containing the masked nodes is fed into the graph neural network, which aggregates the information of the unmasked neighboring nodes through a message passing mechanism to generate the embedded representations of all nodes. For the masked nodes, an attribute reconstruction decoder (such as a multilayer perceptron) is used to predict the original attribute values ​​from their embedded representations, and the mean squared error loss between the predicted values ​​and the true attribute values ​​is calculated. By minimizing this reconstruction loss through backpropagation, the model is forced to learn the inherent rules of inferring missing attributes using the graph structure and unmasked attributes.

[0059] Step 403, the edge existence prediction task, includes: randomly deleting some edges from the heterogeneous graph; predicting the existence of the deleted edges using a graph neural network; and updating the graph neural network parameters by minimizing the cross-entropy loss between the predicted edge existence and the actual edge existence. During pre-training, edge-level perturbation is applied to the heterogeneous graph. Specifically, a portion of the actually existing edges in the graph are randomly deleted (e.g., 10%), while an equal number of non-existent node pairs are sampled as negative samples. The graph neural network recalculates the node embeddings on the perturbed graph and then calculates an existence score for each pair of nodes (e.g., by using the inner product of the node embeddings and transforming it with a sigmoid function). The predicted existence probability is compared with the true labels (1 for true edges, 0 for false edges), and the difference is quantified using a binary classification cross-entropy loss function. By optimizing this loss, the graph neural network is trained to accurately determine the existence of edges, thereby capturing the hidden structural relationships in the heterogeneous graph.

[0060] Step 404: Perform data augmentation on the heterogeneous graph to generate at least one augmented view; based on the heterogeneous graph and the augmented view, maximize the mutual information between node representations through a contrastive learning task; update the graph neural network parameters based on the contrastive learning loss. First, apply data augmentation techniques to the original heterogeneous graph, such as randomly discarding a certain proportion of edges or randomly masking some node attributes to generate an augmented view. This augmented view and the original view form a pair of positively correlated perspectives. The two views are fed into a graph neural network (usually an encoder with shared parameters) to obtain the representation vectors of each node in the two views. The goal of the contrastive learning task is to maximize the mutual information of the same node in different views. A typical approach is to use the InfoNCE loss function: treating the representations of the same node in different views as positive sample pairs, and the representations of different nodes in different views as negative sample pairs, optimizing by calculating similarity and taking the negative log-likelihood after softmax normalization. By minimizing the contrastive loss, the model learns to extract robust node representations that are insensitive to data augmentation, further improving the generalization ability of the pre-trained model on downstream tasks.

[0061] Step 402, the node attribute mask reconstruction task includes: randomly masking the attribute vectors of some nodes in the heterogeneous graph; using a graph neural network to predict the attribute vectors of the masked nodes based on the attributes of the unmasked nodes and the graph structure; and updating the parameters of the graph neural network by minimizing the difference between the predicted attribute vectors and the true attribute vectors.

[0062] Specifically, in step 402, in each training iteration, the node attribute matrix of the input heterogeneous graph is randomly masked. For example, approximately 15% of the nodes are randomly selected, and their original attribute vectors are set to all zeros or noise vectors. Subsequently, the heterogeneous graph containing the masked nodes is fed into a graph neural network. The network aggregates information from unmasked neighboring nodes through a message-passing mechanism to generate embedded representations of all nodes. For the masked nodes, an attribute reconstruction decoder (such as a multilayer perceptron) is used to predict the original attribute values ​​from their embedded representations, and the mean squared error loss between the predicted and true attribute values ​​is calculated. By minimizing this reconstruction loss through backpropagation, the model is forced to learn the inherent patterns of inferring missing attributes using the graph structure and unmasked attributes.

[0063] Step 403, the edge existence prediction task includes: randomly deleting some edges in the heterogeneous graph; using a graph neural network to predict the existence of the deleted edges; and updating the graph neural network parameters by minimizing the cross-entropy loss between the predicted edge existence and the actual edge existence.

[0064] During pre-training, edge-level perturbation is applied to the heterogeneous graph. Specifically, a subset of actually existing edges (e.g., 10%) are randomly removed from the graph, while an equal number of non-existent node pairs are sampled as negative samples. The graph neural network recomputes the node embeddings on the perturbed graph and then calculates an existence score for each pair of nodes (e.g., by transforming the inner product of the node embeddings using a sigmoid function). The predicted existence probability is compared with the true labels (1 for true edges, 0 for false edges), and the difference is quantified using a binary cross-entropy loss function. By optimizing this loss, the graph neural network is trained to accurately determine the existence of edges, thereby capturing hidden structural relationships in heterogeneous graphs.

[0065] Step 404: Perform data augmentation on the heterogeneous graph to generate at least one augmented view; based on the heterogeneous graph and the augmented view, maximize the mutual information between node representations through a contrastive learning task; update the graph neural network parameters based on the contrastive learning loss.

[0066] First, data augmentation techniques are applied to the original heterogeneous graph, such as randomly discarding a certain proportion of edges or randomly masking some node attributes to generate an augmented view. This augmented view and the original view form a pair of positively correlated perspectives. The two views are then fed into a graph neural network (usually an encoder with shared parameters) to obtain the representation vectors of each node in both views. The goal of the contrastive learning task is to maximize the mutual information of the same node across different views. A typical approach is to use the InfoNCE loss function: treating the representations of the same node across different views as positive sample pairs, and the representations of different nodes across different views as negative sample pairs, optimizing by calculating similarity, applying softmax normalization, and then taking the negative log-likelihood. By minimizing the contrastive loss, the model learns to extract robust node representations that are insensitive to data augmentation, further improving the generalization ability of the pre-trained model on downstream tasks.

[0067] Step 501, the step of performing threat assessment on the behavioral edges in the heterogeneous graph based on the pre-trained model to obtain detection results includes: using the pre-trained model to perform forward propagation on each behavioral edge in the heterogeneous graph to obtain the embedding representation of the edge; inputting the embedding representation into the anomaly detector to obtain a threat score; and determining the threat edge and outputting the detection result based on a preset threat score threshold.

[0068] Specifically, in step 501, the pre-trained model is used to perform forward propagation on each behavioral edge in the heterogeneous graph to obtain the embedding representation of that edge. The first sub-step of threat assessment involves concatenating or weighting the features of the subject node connected to the edge (e.g., user identity, department attributes), the object node features (e.g., file type, host label), and the edge's own attribute features (e.g., operation timestamp, command word, access frequency, historical success rate) as input to the pre-trained model. This pre-trained model can be a multi-layer graph convolutional network or a graph attention network. Through local subgraph sampling and message passing, it gradually fuses the behavioral patterns of neighboring nodes, ultimately outputting a fixed-length embedding vector for each behavioral edge. This embedding representation effectively encodes the structural position and abnormal deviation degree of the behavioral edge within the overall behavioral context, providing high-quality features for subsequent discrimination.

[0069] Step 502: Input the embedded representation into the anomaly detector to obtain a threat score. Specifically, after obtaining the embedded representation of each behavior edge, the threat level is quantified by feeding the embedded vector into a pre-trained anomaly detector. This anomaly detector can employ an autoencoder model based on reconstruction error, using unsupervised training with the embedding vectors of a massive number of normal behavior edges to learn the low-dimensional manifold distribution of normal behavior. For the embedding to be tested, the reconstruction error (e.g., mean squared error) is calculated, and the error value is normalized to a threat score between 0 and 1; the larger the error, the higher the threat score. Alternatively, an isolated forest or a single-class support vector machine can be used as the detector to directly output the anomaly score.

[0070] Step 503: Based on a preset threat scoring threshold, identify threat edges and output detection results. Specifically, after obtaining the threat score for each behavioral edge, the decision mechanism from score to alert is as follows: compare the threat score with a preset threat scoring threshold. This threshold can be automatically determined based on historical alert data by maximizing the harmonic mean of recall and precision (F1-score), or configured by security experts to a fixed value (e.g., 0.85). For edges with a threat score greater than or equal to the threshold, they are marked as threat edges, and key information such as their source node, target node, threat score, and time window are extracted to form a detection record. All detection records are aggregated to generate structured detection results (such as a JSON-formatted alert list), which are ultimately output to the security information and event management platform or risk control interface, completing the response loop.

[0071] The host threat detection method based on multi-source heterogeneous data pre-training in this embodiment transforms heterogeneous system audit logs into structured graph data and uses a self-supervised pre-trained graph neural network model to capture complex temporal, structural, and semantic relationships within the host, thereby achieving efficient threat detection.

[0072] Example 2 like Figure 2 The diagram shown is a logic diagram of the host threat detection method based on multi-source heterogeneous data pre-training in this embodiment. It may further include the following steps: S1, Data Preprocessing and Heterogeneous Graph Construction: This application first performs unified cleaning and standardization on the raw multi-source heterogeneous system logs (including behavioral data such as processes, files, network streams, registry entries, and threads). The specific process is as follows: S11, Log Standardization and Time Alignment: Standardize the timestamp format of logs and use interpolation algorithms for valid times before and after to fill in missing timestamps, ensuring the temporal continuity of the log stream.

[0073] S12, Feature Extraction and Representation: S121, Structural features: Mapping different types of objects (such as process ID, host address, file path) to nodes in the graph, and mapping behaviors to edges in the graph.

[0074] S122, Text Features: Semantically encode path-type attributes (such as file paths and command parameters) using a SentenceTransformer model (such as all-MiniLM-L6-v2) and transform them into high-dimensional vectors.

[0075] S123, Numerical Features: Numerical features such as frequency and magnitude are processed using log1p, and combined with the statistical maxima calculated in the pre-training stage for Min-Max normalization to solve the problem of data distribution offset between different hosts.

[0076] S13, Heterogeneous Graph Construction: Construct a heterogeneous source graph of data structures, including two types of nodes (remote nodes and local nodes) and two types of edges (internal host interaction and network flow).

[0077] S14, Time-series index construction: For each node in the graph, construct an adjacent edge column arranged in descending order of time to support efficient time-series retrieval of node historical behavior.

[0078] S2, a spatiotemporally aware graph neural network model architecture. The graph neural network model used in this application aims to integrate heterogeneous node attributes and dynamic temporal behavior. The core components of the model include: S21, Node Feature Fusion Module: Through linear layers and ReLU (Modified Linear Unit) activation function, the standardized numerical features are fused with the text semantic vector, and node type identifiers (such as whether it is a local node) are added to output a unified node latent space representation.

[0079] S22, Spatiotemporal Heterogeneous Graph Convolution: HEATConv (Heterogeneous Edge Enhanced Graph Attention Operator) is used as the core graph convolutional layer operator. This operator explicitly models the interactions between different edge types, edge attributes, and node types through an edge attention mechanism, which can effectively perform message passing on heterogeneous graphs and capture the structural threat relationships of hosts.

[0080] S23, Temporal Context Encoder: To capture the dynamic threat context of edges, this module introduces a temporal correlation cross-attention mechanism. For a target edge, the encoder retrieves the historical behavioral event sequences of its source and destination nodes and passes them through a time-interval-based gating function. Events are time-sensitively weighted, with a greater emphasis on recent events, ultimately achieving a contextual semantic representation of dynamic threat backgrounds.

[0081] S3, This application utilizes unlabeled system logs and designs the following four complementary pre-training tasks to achieve deep mining of host behavior patterns: S31, Node Attribute Masking Autoencoder Task: Randomly mask the fusion features of some nodes, reconstruct the masked features using a graph neural network, and enable the model to learn the global distribution and local contextual dependencies of node attributes.

[0082] S32, Node Behavior Prediction Task: Based on the preceding behavior sequence of a given node, predict the type of the next behavior (such as action type, network attribute) to enhance the model's ability to model the logic of behavior evolution.

[0083] S33, Cross-modal Masked Edge Modeling Task: This task involves modeling masked edges and their contexts. Using an edge context encoder and an interactive attention algorithm, the historical context of the source and destination nodes is integrated to predict the attributes of the masked edges. This task forces the model to learn cross-modal associations between structural and behavioral temporal information.

[0084] S34, Temporal Adjacency Node-Edge Comparison Learning Task: By leveraging heterogeneous graph data augmentation to generate multiple views, and using edge context representations as input to perform InfoNCE contrastive loss, we maximize the mutual information of representations of temporally adjacent edges with similar behaviors in the same process. We learn robust behavioral features that are not affected by time perturbations or data augmentation changes, thereby reducing false positives in downstream anomaly detection.

[0085] S4, the fine-tuning method specifically includes the following steps: Step S41, Load the pre-trained model and initialize the supervision head: Load the pre-trained weights into the backbone network. Independently initialize or reinitialize the supervision detection-related heads (especially the binary classification edge detection head). Construct the supervision fine-tuning graph data input (node ​​features, edge features, edge types, edge temporal sequences, etc.).

[0086] Step S42, construct the training and validation sets: Divide the edge samples into training and validation sets according to a predetermined ratio. A stratified partitioning method is used to maintain a consistent ratio of positive to negative samples and prevent validation bias. This yields a training positive sample pool and a training negative sample pool, preparing for balanced sampling.

[0087] Step S43, Edge-level supervision objective definition: The model output is the malicious probability p of each edge. The training loss uses Focal Loss, in the following form: ;in, To correspond to the predicted probability of the true class, α and γ are used to reduce the weight of easily classified samples and strengthen the learning of difficult samples.

[0088] Step S44, Forward computation of edge context: First, compute node embeddings on the entire graph. For each edge in a batch, extract the event sequence context of the source and target nodes before the edge's occurrence. The edge representation h_edge is obtained by fusing the event encoder and edge context module. Combined with edge type information, input into a binary classifier, and output malicious logit / probability.

[0089] Step S45, Two-Stage Fine-Tuning (LP-FT): Stage A (Linear Probing Stage): Freeze the backbone and train only the side context encoding module and the binary classification head. Stage B (Joint Fine-Tuning Stage): Unfreeze the backbone and jointly optimize using differential learning rates. The backbone learning rate is lower than the head learning rate to avoid catastrophic forgetting. Learning rate scheduling can use "warmup + cosine annealing".

[0090] Step S46, Model Selection and Early Stopping: Periodically evaluate metrics such as AUC, AP, and F1 on the validation set. Save the optimal weights using the validation set AP as the primary model selection metric. Export the fine-tuned model file and inference parameter file for direct loading during the detection phase.

[0091] Step S5, host threat detection process, includes: Step S51, Load Model and Threshold Strategy: Load the optimal model parameters after supervised fine-tuning. Load the threshold configuration and default threshold strategy. The default strategy (e.g., fixed target alarm rate) can be overridden according to deployment requirements.

[0092] Step S52, Input the graph to be tested and calculate node embeddings in one go: Input the graph to be tested (which can be organized by host / time window). First, perform a full graph node forward pass, calculating node representations only once to reduce redundant overhead.

[0093] Step S53, Batch Context Reasoning: The edges to be tested are grouped and processed in batches. For each edge, the event context sequence of the source / target node before the edge occurs is extracted. The edge representation is obtained through context encoding and fusion. The malicious probability score of the edge is output through the supervised classification head, score∈[0,1].

[0094] Step S54, Threshold determination and alarm generation: Based on the optimal threshold thr selected on the validation set; determination rule: if score>= thr, it is determined as a malicious edge and an alarm is output.

[0095] In summary, the beneficial effects of this application are as follows, compared with the prior art: Under the constraint of training solely based on benign event logs, this application can more effectively distinguish between normal behavior and attack behavior through a detection process of "pre-trained representation transfer + supervised fine-tuning". In particular, it significantly reduces false alarms and improves alarm effectiveness in extreme class imbalance scenarios. Thus, while ensuring detection recall capabilities, it significantly improves accuracy and the comprehensive index F1, and has higher engineering practical value and deployment feasibility.

[0096] The DARPA Operationally Transparent Cyber ​​Dataset (OpTC) was chosen as the test dataset. OpTC contains over 17 billion events from an enterprise network, describing benign and malicious behaviors through network and host-level logs, with malicious behaviors accounting for approximately 0.0016%. Its massive capacity and richness make it highly suitable for training statistical machine learning and deep learning models to detect complex and covert threat behaviors. During pre-training, benign logs generated by 15 hosts not participating in the attack and defense exercises were selected as the pre-training set. For fine-tuning and testing, three hosts that were primarily attacked (SysClient0201, SysClient0501, and SysClient0051) were selected as the test objects. The specific data collection method was as follows: 5% of the benign and attack logs were stratified from the three hosts as the fine-tuning and validation sets, and the remaining logs were used as the test set. The comparison results are shown in Table 1. It can be seen that this application has a significant advantage in average precision and F1 score.

[0097] Table 1 Comparison of the effects of this application and methods without pre-training.

[0098] In one embodiment of this application, a heterogeneous graph is constructed using massive unlabeled system audit logs without any attack labels, and the following four complementary pre-training tasks are jointly optimized: (1) Node attribute masking autoencoder task - randomly mask the fusion features of some nodes and reconstruct them using graph neural networks to learn the global distribution and local contextual dependencies of node attributes; (2) Node behavior sequence prediction task - based on the preceding behavior sequence of a given node, predict the type and attribute of the next behavior and model the behavior evolution logic; (3) Cross-modal masked edge modeling task - mask some edges and their context, integrate the historical behavior sequences of the source node and the destination node using a temporal context encoder, predict the attributes of the masked edge, and force the model to learn the cross-modal association between structural information and behavioral temporal information; (4) Temporal adjacent node-edge comparison learning task - using the temporal context representation of the edge as input, adopting multi-view data augmentation and InfoNCE loss, mining the representation consistency of temporally adjacent behaviors in the same process, and learning robust and disturbance-resistant behavior embedding features. The losses of the four tasks are jointly optimized during the pre-training phase, enabling the model to obtain a general deep representation of the host's behavioral patterns.

[0099] In one embodiment of this application, for a target edge, the historical behavior event sequences of its source and target nodes are retrieved. A time-sensitive weighting function based on time intervals is used to enhance the weight of recent events and attenuate the influence of distant events. Finally, the temporal context representations of the source and target edges are fused through cross-attention to output a dynamic threat background semantic representation of a single edge (behavior). This method enables efficient retrieval and modeling of the historical behavior sequences of any node at any time, supporting refined threat assessment at the edge level.

[0100] In one embodiment of this application, the historical behavior event sequences of the source node and the destination node are retrieved respectively, and the edge-level semantic representation is generated according to the following process: (1) Dual-path architecture: Construct a stable node pair path `h_pair = proj(concat(h_src_node,h_dst_node))` as the skeleton signal, and at the same time construct a context path as an optional enhancement; (2) Side Independent Self-Attention Encoding: Apply shared self-attention encoding with side tags to the historical event sequences of the source and destination ends respectively, skip completely empty sequence lines, and avoid injecting fake tokens; (3) Smoothing time gating: using an exponential decay gating function Time-sensitive weighting is applied to encoded historical events, where the learnable temperature parameter is included. Control the decay rate to strengthen the weight of recent events while retaining the modest contribution of distant but relevant events; (4) Conditional cross attention interaction: cross attention is performed on the destination query and the source key-value pair (the output is located on the destination axis). It is activated only when there is a valid context on both ends; otherwise, it degenerates into an identity mapping. (5) Learning-based gating fusion: The context signal is incorporated into the node pair signal by learning-based g = sigmoid(MLP([h_pair, h_ctx])), h_edge = h_pair + g · h_ctx, ensuring that the noisy context does not overwhelm the stable node pair signal.

[0101] In one embodiment of this application, log1p logarithmic transformation is applied to numerical features from different sources, combined with Min-Max normalization of statistical maxima saved during the pre-training stage; the SentenceTransformer semantic encoding model is used to obtain high-dimensional semantic vectors for text-type attributes; during the heterogeneous graph construction stage, the type attributes of network flow nodes and local entity nodes are distinguished, and node type, edge type and network flow identification information are retained through type masking for subsequent differential modeling and scoring, thereby overcoming the problem of inconsistent statistical distribution of log data under different host environments.

[0102] The host threat detection method based on multi-source heterogeneous data pre-training in this application embodiment transforms heterogeneous system audit logs into structured graph data and uses a self-supervised pre-trained graph neural network model to capture complex temporal, structural, and semantic relationships within the host, thereby achieving efficient threat detection.

[0103] Example 3 In yet another embodiment, such as Figure 3 As shown, this application provides a host threat detection system 10 based on multi-source heterogeneous data pre-training, comprising: The acquisition module 100 is used to acquire multi-source heterogeneous host behavior data; The graph construction module 200 is used to construct a heterogeneous graph based on the host behavior data; wherein, the nodes in the heterogeneous graph represent host entities, and the edges represent the interaction behaviors between entities; The pre-training module 300 is used to train the graph neural network using a multi-task self-supervised pre-training strategy to obtain a pre-trained model. The detection module 400 is used to perform threat assessment on the behavioral edges in the heterogeneous graph based on the pre-trained model and obtain the detection results.

[0104] The pre-training module performs four self-supervised pre-training tasks: node attribute mask autoencoding, node behavior prediction, cross-modal mask edge modeling, and temporal adjacent node-edge contrastive learning. The latter two tasks use edge temporal context representation as model input. The graph neural network is optimized by combining the losses of the four tasks to complete unlabeled pre-training.

[0105] This application provides a host threat detection system based on multi-source heterogeneous data pre-training. By converting heterogeneous system audit logs into structured graph data and using a self-supervised pre-trained graph neural network model to capture complex temporal, structural, and semantic relationships within the host, it achieves efficient threat detection.

[0106] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0107] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A host threat detection method based on multi-source heterogeneous data pre-training, characterized in that, include: Acquire multi-source heterogeneous host behavior data; A heterogeneous graph is constructed based on the host behavior data; wherein, nodes in the heterogeneous graph represent host entities, and edges represent interaction behaviors between entities; A pre-trained model is obtained by training a graph neural network using a multi-task self-supervised pre-training strategy. Threat assessment of behavioral edges in the heterogeneous graph is performed based on the pre-trained model to obtain detection results.

2. The method according to claim 1, characterized in that, The acquisition of multi-source heterogeneous host behavior data includes: Collect system call logs and network traffic data from heterogeneous operating systems; The collected logs and data are timestamped and formatted to obtain a standardized sequence of behavioral records.

3. The method according to claim 1, characterized in that, The step of constructing a heterogeneous graph based on the behavioral data includes: Extract processes, files, and network sockets as node types from the host behavior data, and extract process creation, file reading and writing, and network connection as edge types; Based on the temporal relationships between entities, a heterogeneous graph with different node and edge types is constructed.

4. The method according to claim 1, characterized in that, The method of training graph neural networks using a multi-task self-supervised pre-training strategy includes: Design a first self-supervised pre-training task and a second self-supervised pre-training task. The first self-supervised pre-training task is node attribute mask reconstruction, and the second self-supervised pre-training task is edge existence prediction. Based on the heterogeneous graph, a first self-supervised pre-training task and a second self-supervised pre-training task are jointly performed to pre-train the graph neural network.

5. The method according to claim 4, characterized in that, The node attribute mask reconstruction task includes: Randomly mask the attribute vectors of some nodes in a heterogeneous graph; Graph neural networks are used to predict the attribute vectors of masked nodes based on the attributes of unmasked nodes and the graph structure. The parameters of the graph neural network are updated by minimizing the difference between the predicted attribute vector and the true attribute vector.

6. The method according to claim 1, characterized in that, The obtained pre-trained model includes: The heterogeneous graph is augmented to generate at least one augmented view; Based on the heterogeneous graph and the enhanced view, the mutual information between node representations is maximized through a contrastive learning task. The graph neural network parameters are updated based on contrastive learning loss.

7. The method according to claim 1, characterized in that, The threat assessment of behavioral edges in the heterogeneous graph based on the pre-trained model yields the following detection results: The pre-trained model is used to perform forward propagation on each behavioral edge in the heterogeneous graph to obtain the embedding representation of the edge; The embedded representation is input into the anomaly detector to obtain a threat score; Compare the threat score with a preset threat score threshold to identify threat edges and output the detection results.

8. The method according to claim 4, characterized in that, The edge existence prediction task includes: Randomly delete some edges in the heterogeneous graph; Predicting the existence of deleted edges using graph neural networks; The graph neural network parameters are updated by minimizing the cross-entropy loss between predicted edge existence and actual edge existence.

9. A host threat detection system based on multi-source heterogeneous data pre-training, characterized in that, include: The acquisition module is used to acquire multi-source heterogeneous host behavior data; A graph construction module is used to construct a heterogeneous graph based on the host behavior data; wherein, nodes in the heterogeneous graph represent host entities, and edges represent interaction behaviors between entities; The pre-training module is used to train the graph neural network using a multi-task self-supervised pre-training strategy to obtain a pre-trained model. The detection module is used to perform threat assessment on the behavioral edges in the heterogeneous graph based on the pre-trained model and obtain the detection results.

Images