Knowledge graph-based data abnormal transmission detection method
CN122933271APending Publication Date: 2026-10-16GAOSONG DIGITAL (XIAMEN) INTELLIGENT TECHNOLOGY CO LTD
0 Cites 0 Cited by
Patent Information
- Application Number
- CN202611396741.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-09-09
- Publication Date
- 2026-10-16
AI Technical Summary
Technical Problem
[0004]本发明的目的是为了解决现有技术中存在传统基于规则阈值、特征匹配或通用机器学习的检测方案,仅能输出异常分数与告警等级,不易呈现异常传输行为的完整因果链路;安全人员处置告警时,需跨防火墙、终端检测系统、域控服务器、文件审计系统等多平台调取日志人工排查,不仅研判耗时长、运维效率低,还易因信息割裂遗漏关键风险节点的缺点,而提出的基于知识图谱的数据异常传输检测方法
Benefits of technology
本发明中,本方法依托异构图神经网络输出的节点级注意力权重系数,在触发异常告警的同时,以目标传输节点为起点自动执行反向回溯,针对上下文关联异构图子图中的各条关系边逐跳筛选,保留每一跳中对异常判定贡献度最高的实体节点与对应关系边,再按照身份认证、行为触发、数据流转的业务因果逻辑顺序拼接;
✦ Generated by Eureka AI based on patent content.
Abstract
The application discloses a data abnormal transmission detection method based on a knowledge graph, relates to the technical field of data transmission detection, and comprises the following steps: inputting a context-associated heterogeneous graph subgraph into a pre-trained heterogeneous graph neural network, performing aggregated calculation on the features of multiple types of nodes and relationships in the subgraph through a heterogeneous attention mechanism, generating a semantic embedding vector of the transmission event, triggering an abnormality alarm if an abnormality score exceeds a preset determination threshold, and performing reverse backtracking based on the attention weight output by the heterogeneous graph neural network, generating and outputting an explainable semantic association path corresponding to the abnormal transmission event; the method automatically performs reverse backtracking with the target transmission node as the starting point based on the node-level attention weight coefficient output by the heterogeneous graph neural network, retains the entity nodes and corresponding relationship edges with the highest contribution to abnormality determination in each hop, and splices them in accordance with the business causal logic sequence of identity authentication, behavior triggering and data flow.
Need to check novelty before this filing date? Find Prior Art