A terminal security operation alarm method, device, system, storage medium and product

Abstract

Embodiments of the present application disclose a terminal security operation alarm method, device, system, storage medium and product. The method comprises: obtaining target behavior data of a terminal to be detected; analyzing the target behavior data, extracting a structured field, and constructing a time sequence heterogeneous graph based on the structured field; inputting the time sequence heterogeneous graph into a quantum-classical hybrid time sequence heterogeneous graph attention network, compressing and encoding the classical features of the time sequence heterogeneous graph into a quantum state, calculating the quantum attention weight of each time sequence neighbor node to the target node using a parameterized quantum circuit, aggregating the quantum enhanced features of each time sequence neighbor node according to the quantum attention weight, obtaining the updated representation of the target node, and outputting a candidate security event based on the updated representation; confirming the candidate security event according to a preset context association rule, and generating a confirmed security event when the confirmation is passed. The scheme can more accurately capture the abnormal behavior pattern of the terminal to be detected, and improve the threat detection capability.

Description

Technical Field

[0001] This application relates to the field of automated security operations technology, and in particular to a terminal security operation alarm method, device, system, storage medium and product. Background Technology

[0002] In enterprise endpoint security operations, threat detection typically involves installing antivirus and endpoint detection and response client software on employee endpoints, configuring security policies on the server side, and collecting logs. Existing endpoint security analysis solutions usually treat logs as independent events, making it difficult to simultaneously characterize the multiple types of relationships between hosts, users, processes, files, network connections, registry entries, vulnerabilities, and alerts, and also difficult to identify potential attack phases from short-term continuous behavioral chains. On the other hand, while traditional graph neural networks can model heterogeneous relationships, they still rely on classical parameter matrices for complex high-dimensional feature mapping and multi-relationship attention calculations, limiting the model's expressive and generalization capabilities. Summary of the Invention

[0003] This application provides a terminal security operation alarm method, device, system, storage medium, and product, which helps to reduce the false alarm rate of terminal security operation risks and improve the terminal security operation threat detection capability.

[0004] According to one aspect of this application, a terminal security operation alarm method is provided, the method comprising: Acquire the behavioral data of the terminal to be tested, and use it as target behavioral data; The target behavior data is parsed to extract structured fields, and a temporal heterogeneous graph is constructed based on the structured fields; the nodes of the temporal heterogeneous graph at least represent terminal entities, the edges represent terminal behaviors between entities, and are associated with time attributes; The temporal heterogeneous graph is input into a quantum-classical hybrid temporal heterogeneous graph attention network. The network compresses and encodes the classical features of the temporal heterogeneous graph into quantum states. The quantum attention weights of each temporal neighbor node to the target node are calculated using parameterized quantum circuits. The quantum enhancement features of each temporal neighbor node are aggregated according to the quantum attention weights to obtain the updated representation of the target node. Candidate security events are output based on the updated representation. The candidate security events are confirmed according to preset context association rules, and a confirmed security event is generated when the confirmation is successful.

[0005] According to one aspect of this application, a terminal security operation alarm device is provided, the device comprising: The target behavior data acquisition module is used to acquire the behavior data of the terminal to be detected, as the target behavior data; The temporal heterogeneous graph construction module is used to parse the target behavior data, extract structured fields, and construct a temporal heterogeneous graph based on the structured fields; the nodes of the temporal heterogeneous graph at least represent terminal entities, the edges represent terminal behaviors between entities, and are associated with time attributes; The quantum-enhanced inference module is used to input the temporal heterogeneous graph into a quantum-classical hybrid temporal heterogeneous graph attention network, so that the classical features of the temporal heterogeneous graph are compressed and encoded into quantum states by the network. The quantum attention weights of each temporal neighbor node to the target node are calculated using parameterized quantum circuits. The quantum-enhanced features of each temporal neighbor node are aggregated according to the quantum attention weights to obtain the updated representation of the target node, and candidate security events are output based on the updated representation. The event confirmation module is used to confirm the candidate security events according to preset context association rules, and generate a confirmed security event when the confirmation is successful.

[0006] According to another aspect of this application, a terminal security operation alarm system is provided, the terminal security operation alarm system comprising: At least one processor; and A memory that is communicatively connected to at least one processor; wherein, The memory stores a computer program that can be executed by at least one processor, such that the at least one processor can execute the terminal security operation alarm method of any embodiment of this application.

[0007] According to another aspect of this application, a computer-readable storage medium is provided, which stores computer instructions for causing a processor to execute and implement the terminal security operation alarm method of any embodiment of this application.

[0008] According to another aspect of this application, a computer program product is provided, which includes a computer program that, when executed by a processor, implements the terminal security operation alarm method of any embodiment of this application.

[0009] The technical solution of this application embodiment involves acquiring behavioral data of the terminal to be detected as target behavioral data; parsing the target behavioral data, extracting structured fields, and constructing a temporal heterogeneous graph based on the structured fields; the nodes of the temporal heterogeneous graph at least represent terminal entities, the edges represent terminal behaviors between entities, and are associated with time attributes; inputting the temporal heterogeneous graph into a quantum-classical hybrid temporal heterogeneous graph attention network, the network compressing and encoding the classical features of the temporal heterogeneous graph into quantum states, calculating the quantum attention weights of each temporal neighbor node to the target node using parameterized quantum circuits, aggregating the quantum enhancement features of each temporal neighbor node according to the quantum attention weights to obtain an updated representation of the target node, and outputting candidate security events based on the updated representation; confirming the candidate security events according to preset context association rules, and generating a confirmed security event when the confirmation is successful. By parsing and constructing terminal behavior data into a temporal heterogeneous graph, with nodes representing terminal entities and edges representing terminal behaviors between entities, and associating them with time attributes, this approach can simultaneously characterize the complex interaction relationships between multiple types of entities such as hosts, users, processes, files, and networks, as well as identify attack phases in short-term continuous behavior chains. This overcomes the shortcomings of traditional solutions that treat logs as isolated events and struggle to capture attack chains. By employing a quantum-classical hybrid temporal heterogeneous graph attention network to determine whether a terminal under test has security operational risks, this approach retains the ability of temporal heterogeneous graphs to model multi-source terminal behavior relationships, aligning with the inherent interaction and graph structure characteristics of process, file, and network entities in terminal security events. Furthermore, it utilizes quantum states to enhance the expression of complex high-dimensional features in the temporal heterogeneous graph, thereby more accurately capturing abnormal behavior patterns of the terminal under test. This helps reduce the false positive rate of terminal security operational risks and improves the detection capability of terminal security operational threats. Simultaneously, by using preset context association rules to perform secondary verification on candidate security events output by the model, the probability of false positives caused by isolated events is further reduced, improving the credibility of alerts.

[0010] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1A flowchart illustrating a terminal security operation alarm method provided in this application embodiment; Figure 2 A schematic diagram of the architecture of a quantum-classical hybrid temporal heterogeneous graph attention network provided in this application embodiment; Figure 3 A complete flowchart of a terminal security operation alarm provided in this application embodiment; Figure 4 A schematic diagram of the framework of a terminal security operation alarm system provided in this application embodiment; Figure 5 A schematic diagram of the structure of a terminal security operation alarm device provided in this application embodiment; Figure 6 This is a schematic diagram of the structure of a terminal security operation alarm system provided in an embodiment of this application. Detailed Implementation

[0013] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0014] It should be noted that the terms "first," "second," "third," "fourth," "actual," "preset," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0015] Figure 1 This flowchart illustrates a terminal security operation alarm method provided in this application embodiment, which is applicable to situations requiring alarms for terminal security operations. The method can be executed by a terminal security operation alarm device, which can be implemented in hardware and / or software and configured within a terminal security operation alarm system. Figure 1 As shown, the method includes: S110. Obtain the behavior data of the terminal to be tested as target behavior data.

[0016] In this embodiment, behavioral data corresponding to the terminal to be detected is obtained as target behavioral data. For example, the terminal security operation alarm method provided in this embodiment is applied to a terminal security operation alarm system. The terminal security operation alarm system may include a terminal security protection subsystem, which includes a client deployed on the terminal to be detected (such as an employee terminal) and a backend server. The client collects the original behavioral data of the terminal to be detected based on the terminal management security policy issued by the server and uploads the original behavioral data to the server. The original behavioral data may include terminal system basic logs, process behavioral data, file behavioral data, network connection behavioral data, and abnormal operation behavioral data. The server processes the original behavioral data to generate target behavioral data; the target behavioral data may include terminal security event data, operation audit data, and hierarchical alarm data. The target behavioral data may be presented in syslog or other preset log formats.

[0017] S120. The target behavior data is parsed, structured fields are extracted, and a temporal heterogeneous graph is constructed based on the structured fields; the nodes of the temporal heterogeneous graph at least represent terminal entities, the edges represent terminal behaviors between entities, and are associated with time attributes.

[0018] In this embodiment, the target behavior data is parsed and processed, including field extraction, field standardization, and time calibration, to extract structured fields from the target behavior data. These structured fields may include terminal identifier, process name, file path, network quintuple, operation time, employee account, risk label, alarm level, and handling suggestions. A time-series heterogeneous graph is constructed based on these structured fields. Each node in the time-series heterogeneous graph represents at least a terminal entity, and edges represent terminal behaviors between entities, all associated with a time attribute. For example, terminal entity objects such as users, hosts, processes, files, network addresses, registry entries, and security alarms are used as nodes, and terminal behaviors such as process creation, file reading / writing, network connection, registry modification, and alarm triggering are used as edges. Each edge is labeled with the event occurrence time and event attributes, thereby generating the time-series heterogeneous graph. For temporal heterogeneous graphs Any security event It can be represented as ,in, Indicates the event source node, Indicates the target node of the event. Indicates the type of event relationship. Indicates the time when the event occurred. This indicates an attribute attached to the event.

[0019] Optionally, the parsing includes: for string fields in the target behavior data, mapping the string fields to character number sequences using a predefined character table, truncating or padding to a fixed length; converting the character number sequences into embedding vector sequences using a character embedding matrix, and pooling the embedding vector sequences to generate a fixed-length string representation; concatenating the fixed-length string representation with the corresponding numerical features, security rule features, and asset context features to generate the original node features.

[0020] Specifically, for string fields such as process names, file paths, command lines, usernames, domain names, or registry paths in the target behavior data, firstly, a pre-defined character table is obtained. The predefined character table includes at least uppercase and lowercase letters, numbers, path separators, periods, underscores, hyphens, colons, spaces, and special characters from the command line. Then, based on the predefined character table, the string fields are mapped to character number sequences, and the character number sequences are truncated or padded to a fixed length. Next, the character number sequence is converted into an embedding vector sequence using a character embedding matrix, and a fixed-length string representation is obtained through average pooling. Finally, the string representation is concatenated with numerical features, security rule features, and asset context features to form the original node features. .

[0021] For example, for string fields Let the character embedding matrix be... Then the first string field The embedding of a character is represented as: The character-level encoding representation of a string field is as follows: The original features of a node are represented as follows: in, This represents numerical characteristics, security rule characteristics, and asset context characteristics.

[0022] Optionally, the parsing further includes: concatenating the network transmission-related attributes and terminal operation-related attributes in the target behavior data into edge attribute features.

[0023] For example, network transmission-related attributes such as network quintuples, port numbers, and protocol types are extracted from the target behavior data to characterize the network layer information of the terminal behavior event; and terminal operation-related attributes such as alarm level, handling action, file operation type, registry operation type, and event source are extracted to characterize the system layer information of the terminal behavior event. Then, the network transmission-related attributes and the terminal operation-related attributes are concatenated to form the edge attribute features of a time-series heterogeneous graph, which are used to characterize the attribute information of the terminal behavior event.

[0024] Optionally, the temporal heterogeneity graph also includes time-coded features, which are used to characterize the temporal context of security events and may include the event occurrence time. Current analysis time With the time of the event relative time interval Time decay value Whether it is during working hours, whether it is at night, and the event density within a preset time window. At least one of the following features. For example, time-encoded features. It can be represented as: .

[0025] Here, TimeEncode represents the time encoding function, used to encode the aforementioned time-related features into a fixed-length time-encoded vector. This time-encoded feature will be compressed and encoded into a quantum state together with the node features and edge attribute features in subsequent steps.

[0026] S130. The temporal heterogeneous graph is input into a quantum-classical hybrid temporal heterogeneous graph attention network. The network compresses and encodes the classical features of the temporal heterogeneous graph into quantum states. The parameterized quantum circuits are used to calculate the quantum attention weights of each temporal neighbor node to the target node. The quantum enhancement features of each temporal neighbor node are aggregated according to the quantum attention weights to obtain the updated representation of the target node. Candidate security events are output based on the updated representation.

[0027] Understandably, the quantum-classical hybrid temporal heterogeneous graph attention network is designed to transform the various attribute features in a temporal heterogeneous graph into quantum-coded features, and analyze these quantum-coded features through an attention mechanism to realize a machine learning model for terminal security event detection. The temporal heterogeneous graph is input into the quantum-classical hybrid temporal heterogeneous graph attention network, enabling the network to analyze the graph.

[0028] In this embodiment, a quantum-classical hybrid temporal heterogeneous graph attention network compresses and encodes classical features in a temporal heterogeneous graph into quantum states, thereby mapping terminal security behavior characteristics to a quantum Hilbert space. The classical features in the temporal heterogeneous graph include node features, edge attribute features, relation types, and temporal encoding features. For example, the quantum-classical hybrid temporal heterogeneous graph attention network can compress and encode node features, edge attributes, relation types, and temporal encodings into corresponding quantum states using parameterized quantum encoding circuitry. Here, quantum states can also be understood as quantum-encoded features.

[0029] Optionally, the network includes a feature compression unit and a quantum feature encoding unit; the feature compression unit is used to: reduce the dimensionality of node features and edge attribute features to a unified low-dimensional space through linear projection, and compress the time-encoded features to the unified low-dimensional space through linear projection; the quantum feature encoding unit is used to: map the compressed node features, edge attribute features, and time-encoded features to corresponding node quantum states, edge quantum states, and time quantum states through angle encoding, and map relation types to relation type quantum states through independent encoding lines.

[0030] In this embodiment, the feature compression unit in the quantum-classical hybrid temporal heterogeneous graph attention network reduces the dimensionality of various high-dimensional classical features in the temporal heterogeneous graph, such as node features, edge attribute features, and temporal encoding, to generate corresponding target graph features suitable for quantum input. It is understood that the classical features in the temporal heterogeneous graph are high-dimensional classical features; therefore, in this embodiment, the high-dimensional classical features are compressed into low-dimensional target graph features suitable for quantum circuit input.

[0031] For example, node features and edge attribute features are reduced to a unified low-dimensional space through linear projection, and temporal encoded features are compressed into the unified low-dimensional space through linear projection. Here, "unified low-dimensional space" refers to mapping the original classical features (node ​​features, edge attribute features, and temporal encoded features) from different sources and dimensions to a low-dimensional vector space of unified dimension (i.e., quantum input dimension) through linear projection, so that quantum feature encoding can be performed uniformly subsequently. This space is a transitional space between the classical feature space and the quantum Hilbert space, and its dimension determines the number of qubits required for quantum feature encoding. For example, the original high-dimensional classical features can be compressed into low-dimensional target graph features based on a classical compression function.

[0032] In one specific implementation, the classical compression function is implemented using linear projection. Specifically, node feature projection matrices are set respectively. Node feature bias term Edge attribute feature projection matrix Edge attribute feature bias term Time-coded projection matrix Time coding bias item And compress the high-dimensional classical features into a unified low-dimensional space according to the following formula: The node feature compression formula is: The formula for compressing edge attribute features is: The time-coding compression formula is: in, , , , , , These represent the original dimensions of node features, edge attribute features, and time-encoded features, respectively. This represents the quantum input dimension (i.e., the feature dimension of the target graph).

[0033] By employing the linear projection method described above, node features, edge attribute features, and temporal encoding features can be uniformly compressed into a single low-dimensional representation space suitable for quantum encoding. Optionally, since the original feature dimensions and semantics of different types of nodes in a temporally heterogeneous graph differ, a type-specific classical compression function can be set for each node type. Based on this classical compression function, the node features of the corresponding node type are mapped to low-dimensional target node features suitable for quantum circuit input. For example, the classical compression function can be implemented using linear projection, that is, a corresponding feature projection matrix and bias term are set for each node type to map the original node features of different dimensions to a unified low-dimensional space.

[0034] In a quantum-classical hybrid temporal heterogeneous graph attention network, the quantum feature encoding unit maps low-dimensional target graph features to corresponding quantum states through parameterized quantum encoding circuits. In one specific implementation, the quantum feature encoding unit performs quantum feature encoding on compressed node features, edge attribute features, and temporal encoded features through parameterized quantum encoding circuits to map them to corresponding quantum states. The quantum feature encoding can be implemented using angular encoding, where the quantum input dimension is 1. Corresponding use Each qubit encodes the compressed node features, edge attribute features, and time features, and maps the relation type to the relation type quantum state through independent encoding circuits.

[0035] Specifically, the compressed eigenvalues ​​are mapped to the rotation angle of a quantum rotation gate and applied to the initial quantum state. Above, node quantum states, edge attribute quantum states, time quantum states, and relation type quantum states are formed. For node characteristics... The nodal quantum state is represented as: The edge-attribute quantum state is represented as: The time quantum state is represented as: The relation type quantum state is represented as: in, This indicates the number of layers in the graph attention network, and the initial layer. hour, , This indicates the number of qubits used by the relation type encoding register. In practice, the compressed features can first be normalized to... or The interval is then used as the rotation angle input to the quantum rotation gate. Preferably, for deep networks, the normalization interval can be limited to [0, π / 2] to mitigate the risk of gradient vanishing.

[0036] Optionally, to reflect the timeliness of terminal security events, embodiments of this application may calculate the current analysis time. With the time of the event Time interval The time decay weight is calculated using the exponential decay function. Specifically, the closer the event occurred to the current analysis time, the greater the time decay weight, meaning its impact on the current risk assessment is greater; conversely, the further back the event occurred from the current analysis time, the smaller the time decay weight, and the smaller its impact on the current risk assessment. This reflects the differentiated importance of time-series behavior patterns in endpoint security risk analysis.

[0037] It should be noted that the time decay weight In the embodiments of this application, it has a dual purpose: on the one hand, it can be used as a quantum rotation gate parameter to participate in quantum feature encoding, so that the quantum state carries time context information; on the other hand, it can be used as a modulation term after the quantum attention score is calculated to perform time decay weighting on the attention score, so as to enhance the impact of recent security events on risk assessment.

[0038] In this embodiment, the time interval and time decay weight can be calculated using the following formula: in, The preset time decay coefficient is used to control the time decay rate.

[0039] In this embodiment, the quantum-classical hybrid temporal heterogeneous graph attention network can employ an attention mechanism, using parameterized quantum circuits to calculate the quantum attention weights of each temporal neighbor node to the target node in the temporal heterogeneous graph. The quantum attention weights are used to characterize the contribution of each temporal neighbor node to the security risk judgment of the target node, and the quantum enhancement features of each temporal neighbor node are aggregated according to the quantum attention weights to obtain an updated representation of the target node that incorporates neighbor information, and candidate security events are output based on the updated representation.

[0040] Optionally, the network includes a series of sequentially connected quantum-classical hybrid graph attention layers and risk prediction layers; each quantum-classical hybrid graph attention layer is used to perform quantum attention aggregation on the temporal neighbor information of each target node in the temporal heterogeneous graph, and output the current update representation of each target node; wherein, the current update representation output by the last quantum-classical hybrid graph attention layer is used as the target update representation; the risk prediction layer is used to generate an abnormal risk score based on the target update representation to determine whether the terminal to be detected has a security operation risk.

[0041] In this embodiment, the quantum-classical hybrid temporal heterogeneous graph attention network includes not only a feature compression unit and a quantum feature encoding unit, but also sequentially connected multi-layer quantum-classical hybrid graph attention layers and a risk prediction layer. Each quantum-classical hybrid graph attention layer is used to perform quantum attention aggregation on the temporal neighbor information of each target node in the temporal heterogeneous graph, outputting the current update representation of each target node. The current update representation is an enhanced representation obtained by multi-head quantum attention weighted aggregation of the temporal neighbor information under each relation type involved in the target node. Through the sequential stacking of multiple quantum-classical hybrid graph attention layers, the output of the previous layer serves as the input of the next layer, achieving iterative aggregation of higher-order neighborhood information layer by layer. The current update representation output by the last quantum-classical hybrid graph attention layer is used as the target update representation of the target node for subsequent processing by the risk prediction layer.

[0042] The target node is any node to be analyzed in the temporally heterogeneous graph. Specifically, the temporally related neighbor information for each relation type involved in the target node is determined. This temporally related neighbor information consists of the quantum states of the association information of neighboring nodes whose temporal attributes are within the same preset time window as the target node. The current quantum-classical hybrid graph attention layer can use an attention mechanism to weighted aggregate the temporally related neighbor information for each relation type involved in the target node, generating the current updated representation of the target node.

[0043] Optionally, the quantum-classical hybrid graph attention layer includes a multi-head quantum attention computation unit, a neighbor quantum information aggregation unit, and a relation-level fusion unit. The multi-head quantum attention computation unit is used to construct multiple attention heads with multiple sets of independently parameterized quantum circuits to compute in parallel the quantum attention weights of each temporal neighbor information for the target node under each relation type. The neighbor quantum information aggregation unit is used to perform weighted aggregation of the temporal neighbor information under each relation type based on each quantum attention weight to generate a neighbor aggregation representation for the relation type. The relation-level fusion unit is used to determine the relation attention weights of the neighbor aggregation representations corresponding to each relation type, and perform weighted aggregation of each neighbor aggregation representation based on each relation attention weight to generate the current updated representation of the target node.

[0044] In this embodiment, for each target node in a temporally heterogeneous graph, a multi-head quantum attention computation unit uses multiple attention heads constructed from multiple sets of independently parameterized quantum circuits to compute in parallel the quantum attention weights of the target node for each temporally adjacent neighbor information under each relation type it is involved in. It is understood that each attention head corresponds to a set of independent parameterized quantum circuits, and each parameterized quantum circuit performs attention computation in parallel to evaluate the importance of temporally adjacent neighbor information to the target node from different security semantic dimensions.

[0045] Optionally, the quantum-classical hybrid graph attention layer includes relation condition parameterized quantum circuit units; the relation condition parameterized quantum circuit units are used to perform quantum evolution on the quantum states associated with the temporal neighbor information according to the relation condition parameterized quantum circuits corresponding to each relation type, to generate relation-enhanced quantum states; the multi-head quantum attention computing unit calculates the quantum attention weights according to the relation-enhanced quantum states.

[0046] In this embodiment, each quantum state corresponds to a different terminal security relationship type. Therefore, different relation condition parameterized quantum circuits can be constructed for different types of terminal security relationships. Regarding the relationship type... , No. The first quantum attention head and the first Layered graph reasoning process, setting parameterized quantum circuits The line receives the target node quantum state, neighbor node quantum state, edge attribute quantum state, relation type quantum state, and time quantum state associated with temporal neighbor information. It learns the higher-order correlations between the source node, target node, relation type, edge attribute, and event time through quantum rotation gates and entanglement gates, and evolves and merges each input quantum state into a relation-enhanced quantum state for subsequent quantum attention weight calculation.

[0047] The higher-order association can be represented as: in, Indicates the first Layer, First Quantum attention head, relation type The corresponding parameterized quantum circuit.

[0048] In this embodiment, the multi-head quantum attention computing unit receives the relation-enhanced quantum state output by the relation conditionally parameterized quantum circuit, measures the relation-enhanced quantum state to obtain the importance score of the target node's temporal neighbor information (which can also be understood as neighbor events) to the target node's security risk assessment, and then determines the quantum attention weight based on the importance score. Optionally, the quantum attention weight is obtained by: performing Pauli-Z observability measurement on the relation-enhanced quantum state to obtain the quantum attention score of each temporal neighbor information to the target node; normalizing the quantum attention scores of each temporal neighbor information within the temporal neighbor set of the same relation type to obtain the quantum attention weight.

[0049] In one specific implementation, the measurement is achieved using the expected value measurement of the Pauli-Z observable. Preferably, the number of measurements in a single inference iteration should be set to a reasonable number to suppress the influence of quantum measurement noise on the stability of the attention weights. Specifically, the number of measurements in a single inference iteration is... Observables corresponding to each quantum attention head Let the Pauli-Z operator be defined as a single qubit, or a weighted sum of Pauli-Z operators on multiple qubits; a multi-head quantum attention computation unit repeatedly performs measurements on the same quantum circuit and averages the measurement results to estimate its expected value. This expected value is used as the neighbor event at the 1st... The importance score of the risk assessment of the target node under each quantum attention head (i.e., the quantum attention score) : In one implementation, if a single-bit Pauli-Z measurement is used, then: If a weighted measurement of multiple qubits is used, then: in, express Pauli-Z operators on qubits This indicates the corresponding weight.

[0050] Optionally, the time decay weight can also be used as a modulation term in the quantum attention score. After adding the time decay weight, the resulting quantum attention modulation score is: in, Indicates the time of neighbor events Relative to the current analysis time Time decay weight.

[0051] For the target node In the same relation type Time-series neighbor information set Within, the obtained quantum attention modulation scores are... After normalization, we obtain the first... Layer, First A quantum attention-based neighbor event For the target node Quantum attention weights .in, Indicates the preset time window Inner and target nodes By relation type A set of interconnected temporally ordered neighbor events. The quantum attention weights are used to represent the contribution of neighbor events to the security risk assessment of the target node under a specific relation type, a specific time window, and a specific quantum attention head. Wherein: The normalized weights satisfy: Optionally, to avoid excessive concentration of attention distribution due to differences in the number of neighbors or quantum measurement noise, during normalization... Can Introducing temperature coefficient : in, .

[0052] In this embodiment, the neighbor quantum information aggregation unit performs weighted aggregation of the temporal neighbor information of the target node under the said relation type based on each quantum attention weight, generating a neighbor aggregation representation of the relation type. For example, after obtaining the quantum attention weights, the neighbor quantum information aggregation unit uses value quantum circuits... The temporal neighbor information (including neighbor node quantum states, edge attribute quantum states, and temporal quantum states) is processed, and the quantum value representation of neighbor events is obtained through measurement readout. Subsequently, based on the obtained quantum attention weights, the same relation type is... We perform weighted aggregation of the time-series neighbor events to obtain the first... Layer, First The neighbor aggregation representation corresponding to each quantum attention head: in, Indicating a neighboring incident In relation types , No. The first quantum attention head and the first The quantum value representation below the layer; Represents the target node Neighbor aggregation representation under correspondence and attention head.

[0053] In this embodiment, the relation-level fusion unit determines the relation attention weights of the neighbor aggregation representations corresponding to each relation type of the target node, and performs weighted aggregation on each neighbor aggregation representation based on the relation attention weights to generate the current updated representation of the target node. For example, a multi-head quantum attention mechanism can be used to extract neighbor event information from multiple security semantic perspectives. Different quantum attention heads can focus on patterns such as process chain anomalies, network outbound connection anomalies, file persistence anomalies, registry persistence, credential access, and alarm co-occurrence. The outputs of multiple quantum attention heads are fused by concatenation and can be further processed through a linear mapping matrix. Transform it into a relational representation with a unified dimension.

[0054] Since different types of terminal security relationships contribute differently to risk assessment, this application further introduces a relationship-level attention mechanism. For each relationship type... According to its multi-head aggregation representation Calculate the importance score of the relationship Subsequently, the scores for all relation types are normalized using the Softmax function to obtain the relation attention weights. Finally, the aggregated representations of each relation type are weighted and summed according to the relation attention weights to obtain the target node's position in the current quantum-classical hybrid graph attention layer (the ). The current update representation of the layer. The relationship importance score, relationship attention weight, and current update representation can be calculated using the following formula: in, Indicates the relationship with the target node The set of related relation types, This is the residual term, used to preserve the representation of the nodes in the previous layer and enhance training stability.

[0055] In this embodiment, iterative aggregation of high-order neighborhood information is achieved by stacking multiple layers of quantum-classical hybrid graph attention layers. For the first... By following the steps described above, the target node can be obtained. The current update indicates .when At that time, The low-dimensional input features required for the next quantum-classical hybrid graph attention layer are mapped using type-specific classical projection functions, and the quantum feature encoding, relational conditional parameterized quantum circuits, multi-head quantum attention computation, and relation-level fusion processes are re-executed until the total number of quantum-classical hybrid graph attention layers is reached. .

[0056] The quantum input characteristics of the next quantum-classical hybrid graph attention layer are: The nodal quantum states of the next quantum-classical hybrid graph attention layer are: go through After layer-by-layer inference, the target node's updated representation is obtained (which can also be understood as the node's final representation). .

[0057] In this embodiment, the risk prediction layer is based on the target update representation output by the last quantum-classical hybrid graph attention layer. For example, the risk prediction layer can update the target representation using a classifier. The analysis is performed to determine the anomaly risk score. It is then determined whether the anomaly risk score exceeds a preset risk threshold; if so, the terminal under test is identified as having a security operational risk.

[0058] Determine the risk probability corresponding to each attack type pre-set by the classifier. For each attack type, determine whether the risk probability is greater than a preset risk threshold. If so, determine that the terminal to be detected has a security operation risk corresponding to that attack type.

[0059] Optionally, the risk prediction layer includes a quantum measurement and reading unit, a risk probability determination unit, and a risk judgment unit; the quantum measurement and reading unit is used to generate a risk feature vector based on the target update representation corresponding to each target node; the risk probability determination unit is used to determine the risk probability corresponding to each attack type and determine an abnormal risk score based on the risk feature vector through a classifier; the risk judgment unit is used to determine that the terminal to be detected has a security operation risk when the abnormal risk score is greater than a preset risk threshold, and to determine the attack type corresponding to the highest risk probability as the security operation risk type.

[0060] In this embodiment, the risk prediction layer includes a quantum measurement reading unit, a risk probability determination unit, and a risk judgment unit. The quantum measurement reading unit constructs a candidate event subgraph based on at least one target node and the edges associated with that target node. The candidate event subgraph representation is generated based on the target update representations corresponding to each target node contained in the candidate event subgraph. For example, the quantum measurement readout unit can obtain the candidate event subgraph representation through a pooling function. : in, Represents a candidate event subgraph The set of target nodes in This represents the pooling function, which can be average pooling, max pooling, or attention pooling.

[0061] In obtaining candidate event subgraph representations Subsequently, the quantum measurement readout unit transforms the candidate event subgraph representation into a risk feature vector. For example, the candidate event subgraph representation reads out the quantum state as follows: The quantum measurement readout characteristics (i.e., the risk characteristic vector) are as follows: The risk probability determination unit is used to determine the risk probability corresponding to each attack type based on the risk feature vector using a classifier, and to determine the anomaly risk score. For example, the risk probability... It can be represented as: Abnormal risk score for: in, Represents the classification matrix, Indicates the category bias term. Representing a fractional matrix The transpose of the matrix, This represents the fractional bias term.

[0062] The risk assessment unit determines the abnormal risk score. If the risk level exceeds a preset risk threshold, the terminal under test is determined to have a security operation risk, and the attack type corresponding to the highest risk probability among all risk probabilities is identified as the security operation risk type of the terminal under test. When it is determined that the terminal under test has a security operation risk based on the target update representation, candidate security events are output. These candidate security events may include the target node that triggered the risk and its corresponding associated information (such as associated terminals, associated process chains, network connections, and file behaviors).

[0063] Optionally, the risk judgment unit is used to determine the abnormal risk score, the attack type corresponding to the maximum risk probability, and the maximum risk probability as candidate security events when the abnormal risk score exceeds a preset risk threshold. For example, when... Exceeding the dynamic threshold At that time, the risk assessment unit outputs candidate security events, that is: The candidate security event includes not only the target node that triggered the risk and its corresponding associated information (such as associated terminals, associated process chains, network connections, and file behavior), but also an abnormal risk score, a target attack type, and an attack type probability. The target attack type is the attack type corresponding to the highest risk probability among all risk probabilities, and the attack type probability is the highest risk probability among all risk probabilities. That is, when the abnormal risk score exceeds a preset risk threshold, the abnormal risk score, the attack type corresponding to the highest risk probability, and the highest risk probability are determined as a candidate security event.

[0064] S140. Confirm the candidate security events according to the preset context association rules, and generate a confirmed security event when the confirmation is successful.

[0065] In this embodiment, candidate security events are secondary-confirmed based on preset context association rules to determine whether they are confirmed security events (or genuine security risk events). Specifically, when a candidate security event meets the preset association rules, risk level threshold, or attack chain integrity condition within the preset context association rules—that is, when the candidate security event passes confirmation—it is determined to be a confirmed security event, and a confirmed security event is generated. Determining a security event may include attack type, severity level, attack stage, evidence chain, and relevant employee identity information.

[0066] Optionally, the preset context association rules include preset attack phase association rules. Confirming the candidate security event according to the preset context association rules includes: obtaining context information of the candidate security event, the context information including at least one of terminal identifier, process chain, network connection record, file operation record, and historical alarm record; verifying the attack chain integrity of the candidate security event based on the context information; and confirming the candidate security event as a security event when the candidate security event and the context information satisfy the preset attack phase association rules. The advantage of this setting is that it can effectively reduce the probability of false positives caused by isolated events.

[0067] Optionally, the method further includes: after confirming that the candidate security event is a security event, generating a security event alarm message, sending the security event alarm message to the first instant messaging software client corresponding to the security operations personnel, and sending a security risk warning message to the second instant messaging software client corresponding to the user to which the terminal to be detected belongs.

[0068] In this embodiment, when a candidate security event is confirmed as a security event, a security event alarm message is generated and sent to the first instant messaging (IM) software client corresponding to the security operations personnel via the instant messaging software open platform interface, so that the security operations personnel can promptly obtain and handle the security event. The security event alarm message may include relevant information such as terminal number, involved employee, attack type, risk probability, original logs, attack stage, severity level, and the entry point for handling the work order.

[0069] Simultaneously, when a candidate security event is confirmed as a security event, a security risk warning message can be sent to the second instant messaging software client corresponding to the user of the terminal under test. This message reminds the user that the terminal under test is at security risk and includes necessary response guidelines. The security risk warning message may include a description of the risk behavior, a warning of the risk's impact, and the type of attack.

[0070] The advantage of this setup is that, by utilizing the two-way notification mechanism of IM, security operations personnel can be informed of and address real threats immediately, while the user to whom the terminal under test belongs is simultaneously alerted, prompting the user to promptly terminate unsafe operations and cooperate in the response. This forms a rapid closed loop of human-machine collaboration, greatly shortening the average response time and improving the level of terminal security protection.

[0071] Optionally, the method further includes: obtaining feedback information submitted by the security operations personnel through the first instant messaging software client regarding the security event alarm message; annotating the associated information corresponding to the candidate security event based on the feedback information, generating incremental training samples, and storing the incremental training samples in an incremental learning buffer; wherein, the associated information includes a temporal heterogeneous graph snapshot, candidate event subgraph, quantum coding features, quantum attention weights, and relational attention weights corresponding to the candidate security event; when the number of incremental training samples in the incremental learning buffer reaches a preset batch size or a preset timed trigger condition is reached, incrementally updating the network based on each of the incremental training samples in the incremental learning buffer.

[0072] In this embodiment, feedback information regarding security incident alerts submitted by security operations personnel via a first instant messaging software client is obtained. This feedback information may include information such as "real attack," "false alarm," and attack type tags. Based on the feedback information, the associated information corresponding to candidate security incidents is annotated to generate incremental training samples. The associated information may include a snapshot of the temporal heterogeneous graph corresponding to the candidate security incident, a candidate event subgraph, quantum encoding features, quantum attention weights, and relational attention weights. The incremental training samples are stored in an incremental learning buffer. When the number of incremental training samples in the incremental learning buffer reaches a preset batch size or a preset timed trigger condition is met, the quantum-classical hybrid temporal heterogeneous graph attention network is incrementally updated based on each incremental training sample in the incremental learning buffer, completing the adaptive evolution of the quantum-classical hybrid temporal heterogeneous graph attention network.

[0073] The advantages of this setup are twofold: firstly, new incremental training samples confirmed by security operations personnel are immediately incorporated into the training, allowing the quantum-classical hybrid temporal heterogeneous graph attention network to master new attack characteristics without needing to retrain the entire network, thus significantly improving the response speed to 0-day or variant attacks; secondly, the combination of human judgment and machine computation forms a continuously optimized security operations system, reducing long-term maintenance costs and extending the effective lifespan of the quantum-classical hybrid temporal heterogeneous graph attention network.

[0074] The technical solution of this application embodiment, which uses a quantum-classical hybrid temporal heterogeneous graph attention network for terminal security operation risk detection and alarm, has at least the following beneficial effects: (1) Unified modeling capability for multi-source heterogeneous behavioral data. By parsing and constructing terminal behavioral data into a time-series heterogeneous graph, with nodes representing terminal entities (such as processes, files, network connections, etc.) and edges representing terminal behaviors between entities, and associating time attributes, it can simultaneously depict the complex interaction relationships between multiple types of entities such as hosts, users, processes, files, and networks, as well as identify attack stages in short-term continuous behavioral chains, overcoming the shortcomings of traditional solutions that treat logs as isolated events and are difficult to capture attack chains.

[0075] (2) Quantum-enhanced feature representation and attention computation capabilities. By compressing and encoding the classical features of temporally heterogeneous graphs into quantum states, and utilizing parameterized quantum circuits to compute quantum attention weights, the complex nonlinear correlations between high-dimensional features can be captured in quantum Hilbert space by leveraging the superposition and entanglement properties of quantum states. Compared to traditional classical graph attention networks, this approach achieves stronger feature representation capabilities with fewer trainable parameters, thereby more accurately capturing abnormal behavior patterns in terminals and improving the detection capability of advanced threats.

[0076] (3) Parallel attention mechanism with multiple security semantic perspectives. Through the multi-head quantum attention mechanism, different quantum attention heads can focus on different security semantic patterns such as process chain anomalies, network external connection anomalies, file persistence anomalies, registry persistence, and credential access, to achieve multi-dimensional parallel reasoning and effectively improve the ability to identify complex attack chains.

[0077] (4) Two-layer attention and high-order graph reasoning. By dynamically weighting and fusing aggregated representations of different relation types through relation-level fusion units, a two-layer attention architecture of node-level attention and relation-level attention is realized. This enables the model to adaptively adjust the contribution weights of different relation types according to the specific security context. Combined with multi-layer stacked quantum graph reasoning, it realizes the perception of multi-hop neighborhood information, further enhancing the accuracy of threat detection.

[0078] (5) Rule confirmation and false alarm suppression. The candidate security events output by the model are confirmed again by pre-set context association rules, and real threats are filtered by attack chain integrity verification, which effectively reduces the probability of false alarms caused by isolated events and improves the credibility of alarms.

[0079] (6) Rapid response closed loop of human-machine collaboration. By using the two-way IM notification mechanism, on the one hand, security operations personnel can be informed and deal with real threats as soon as possible, and on the other hand, the user to whom the terminal under test belongs is alerted at the same time, prompting the user to stop unsafe operations and cooperate in the response in a timely manner, forming a rapid closed loop of human-machine collaboration, which greatly shortens the average response time and improves the level of terminal security protection.

[0080] (7) Continuous model evolution and adaptive capability. New incremental training samples confirmed by security operations personnel are immediately incorporated into the training. The quantum-classical hybrid temporal heterogeneous graph attention network can master new attack characteristics without retraining the entire network, and the response speed to 0-day or variant attacks is significantly improved. The combination of human judgment and machine calculation forms a continuously optimized security operation system, reducing long-term maintenance costs and extending the effective life cycle of the model.

[0081] (8) End-to-end automated threat assessment. Through the coordinated efforts of time-series heterogeneous graph modeling, quantum-enhanced reasoning, rule confirmation, IM two-way notification and incremental learning, a self-closed-loop system was constructed, from raw behavioral data to highly reliable security alerts and then to continuously evolving models. This achieved a solution-level leap from fragmented log analysis to intelligent and automated threat assessment in endpoint security operations.

[0082] For example, Figure 2 This is a schematic diagram of the architecture of a quantum-classical hybrid temporal heterogeneous graph attention network provided in an embodiment of this application. Figure 2 As shown, the quantum-classical hybrid temporal heterogeneous graph attention network includes a quantum feature encoding layer, a parameterized quantum circuit layer, and a quantum measurement readout layer.

[0083] The parameterized quantum circuit layer consists of multiple parameterized single-quantum rotation gates and controlled non-entangled gates. , , The parameterized single-quantum rotation gates, representing rotations around the X, Y, and Z axes respectively, are used to encode compressed classical features into quantum states and introduce trainable parameters into the quantum circuit. CX represents a controlled non-entangled gate, used to couple different qubits, enabling the quantum circuit to capture correlations between different feature dimensions. Through the combination of these rotation and entanglement gates, the parameterized quantum circuit can evolve the input quantum state, achieving quantum-enhanced feature transformation and attention computation.

[0084] It should be noted that this diagram is merely an exemplary logical architecture illustration of this application, intended to illustrate the basic principles and data flow of this application, and does not constitute a strict limitation on the scope of protection of the embodiments of this application. Those skilled in the art should understand that in practical applications, the specific topology, number of layers, and parameter configuration of the model can be adjusted according to actual needs.

[0085] The technical solution of this application embodiment, on the one hand, uses a quantum-classical hybrid temporal heterogeneous graph attention network to determine whether a terminal under test has security operation risks. This not only retains the ability of temporal heterogeneous graphs to model the behavioral relationships of multi-source terminals, aligning with the inherent entity interactions and graph structure characteristics of terminal security events such as processes, files, and networks, but also utilizes quantum states to enhance the expression of complex high-dimensional features in the temporal heterogeneous graph. This allows for more accurate capture of abnormal behavior patterns of the terminal under test, helping to reduce the false alarm rate of terminal security operation risks and improve the detection capability of terminal security operation threats. On the other hand, the quantum-classical hybrid temporal heterogeneous graph attention network uses a multi-head quantum attention mechanism to determine the quantum enhanced representation. Different quantum attention heads can respectively focus on security semantics such as process chain anomalies, network external connection anomalies, file persistence anomalies, registry persistence, credential access, vulnerability exploitation context, and alarm co-occurrence, realizing multi-dimensional parallel reasoning, thereby improving the ability to identify complex attack chains.

[0086] For example, Figure 3 This application provides a complete flowchart of a terminal security operation alarm, which, in conjunction with the description of the above embodiments, can be used to... Figure 3 The meaning is clear and will not be elaborated upon here.

[0087] In the embodiments of this application, such as Figure 3 As shown, the terminal security operation alarm system includes a terminal security protection subsystem, a quantum-enhanced security analysis platform, and an alarm push unit.

[0088] The terminal security protection subsystem is used to acquire target behavior data corresponding to the terminal to be tested. Specifically, the terminal security protection subsystem includes a client deployed on the terminal to be tested and a backend server. The client collects the raw behavior data of the terminal to be tested according to the security policy issued by the server. The server processes the raw behavior data to generate target behavior data.

[0089] The quantum-enhanced security analysis platform is connected to the terminal security protection subsystem. It receives the target behavior data, constructs a temporal heterogeneous graph based on the target behavior data, and identifies security events on the temporal heterogeneous graph using a quantum-classical hybrid temporal heterogeneous graph attention network. Specifically, the quantum-classical hybrid temporal heterogeneous graph attention network performs risk scoring, anomaly detection, and attack type identification on terminal security events through classical feature construction and quantum input compression, quantum feature encoding, relational conditional parameterization quantum circuits, multi-head quantum attention mechanisms, relational-level fusion, and quantum measurement readout mechanisms, and outputs candidate security events.

[0090] The alarm push unit is connected to the quantum-enhanced security analysis platform and the instant messaging software open platform, respectively. After the quantum-enhanced security analysis platform confirms a security event, it generates a security event alarm message and sends it to the first instant messaging software client corresponding to the security operations personnel, and generates a security risk warning message and sends it to the second instant messaging software client corresponding to the user to which the terminal to be detected belongs.

[0091] In addition, the alarm push unit is also used to receive the handling confirmation result submitted by the security operations personnel through the instant messaging software client, and send the handling confirmation result back to the quantum-enhanced security analysis platform; the quantum-enhanced security analysis platform generates incremental training samples based on the handling confirmation result, and performs incremental updates on the quantum-classical hybrid temporal heterogeneous graph attention network based on the incremental training samples.

[0092] Furthermore, such as Figure 3 As shown, the quantum-enhanced security analysis platform may include: a data preprocessing module, a temporal heterogeneous graph construction module, a quantum-classical hybrid temporal heterogeneous graph attention network, an event confirmation module, a quantum circuit execution and resource scheduling module, and a quantum model online update module; wherein, the quantum-classical hybrid temporal heterogeneous graph attention network includes a feature compression unit, a quantum feature encoding unit, a relation condition parameterized quantum circuit unit, a multi-head quantum attention calculation unit, a neighbor quantum information aggregation unit, a relation-level fusion unit, and a risk prediction layer. Specifically: The data preprocessing module is used to parse the target behavior data presented as syslog logs into structured fields, which include elements such as terminal identifier, process name, file path, network 5-tuple, and operation time. The temporal heterogeneous graph construction module constructs temporal heterogeneous graphs containing multiple types of nodes and multiple types of edges based on structured fields; The feature compression unit compresses high-dimensional classical features such as node features, edge attributes, relation types, and time encoding in temporal heterogeneous graphs into low-dimensional target graph features suitable for quantum circuit input. The quantum feature encoding unit is used to map the compressed node features, edge attributes, relation types and time codes, and other low-dimensional target graph features into quantum states, so that the terminal security behavior features are mapped to the quantum Hilbert space. The relation condition parameterized quantum circuit unit constructs relation condition parameterized quantum circuits for different terminal security relation types. Based on the relation condition parameterized quantum circuits corresponding to the terminal security relation types, it performs quantum evolution calculations on each quantum state associated with the temporal neighbor information to generate relation enhancement quantum states. The multi-head quantum attention computing unit constructs multiple attention heads through multiple independent parameterized quantum circuits. Based on the relation-enhanced quantum state, it calculates the contribution of different temporal neighbor information under each relation type to the judgment of the security risk of the target node (i.e., quantum attention weight). The neighbor quantum information aggregation unit weights and aggregates the temporal neighbor information for each relation type according to the quantum attention weights to generate the neighbor aggregation representation of the target node for each relation type. The relation-level fusion unit calculates relation attention weights based on the quantum multi-head aggregation results under different relation types, and fuses the neighbor aggregation representations of multiple relation types based on the relation attention weights to obtain the target update representation of the target node or candidate event subgraph. The risk prediction layer performs quantum measurement readout on the target update representation of the target node or candidate event subgraph output by the relation-level fusion unit to obtain the risk feature vector. The classifier outputs the risk probability corresponding to each attack type based on the risk feature vector and determines the abnormal risk score based on the risk feature vector. When the abnormal risk score exceeds the dynamic risk threshold, the candidate security event is output. The event confirmation module is used to confirm candidate security events by combining preset context association rules, reducing the probability of false alarms caused by isolated events, and attaching the severity level, attack stage and the identity information of the employees involved.

[0093] The quantum circuit execution and resource scheduling module is used to execute quantum feature encoding circuits, relational condition parameterization quantum circuits, multi-head quantum attention circuits, quantum value representation circuits, and quantum measurement readout circuits.

[0094] The quantum model online update module is used to receive the confirmation results of the alarm from the security operations personnel, and form incremental training samples with the original log of the security risk event. These samples are stored in the incremental learning buffer. When the number of samples in the buffer reaches a preset threshold or the timed triggering condition is met, the quantum-classical hybrid temporal heterogeneous graph attention network is updated.

[0095] For example, Figure 4 This is a schematic diagram of the framework of a terminal security operation alarm system provided in an embodiment of this application.

[0096] Figure 5 This is a schematic diagram of a terminal security operation alarm device provided in an embodiment of this application. This device can execute the terminal security operation alarm method provided in any embodiment of this application, and has the corresponding functional modules and beneficial effects for executing the method. Figure 5 As shown, the device includes: The target behavior data acquisition module 510 is used to acquire the behavior data of the terminal to be detected as target behavior data. The temporal heterogeneous graph construction module 520 is used to parse the target behavior data, extract structured fields, and construct a temporal heterogeneous graph based on the structured fields; the nodes of the temporal heterogeneous graph at least represent terminal entities, the edges represent terminal behaviors between entities, and are associated with time attributes; The quantum-enhanced inference module 530 is used to input the temporal heterogeneous graph into a quantum-classical hybrid temporal heterogeneous graph attention network, so that the classical features of the temporal heterogeneous graph are compressed and encoded into quantum states by the network, the quantum attention weights of each temporal neighbor node to the target node are calculated using parameterized quantum circuits, the quantum-enhanced features of each temporal neighbor node are aggregated according to the quantum attention weights to obtain the updated representation of the target node, and candidate security events are output based on the updated representation. The event confirmation module 540 is used to confirm the candidate security event according to the preset context association rules, and generate a confirmed security event when the confirmation is successful.

[0097] Optional, a time-series heterogeneous graph construction module, used for: For string fields in the target behavior data, the string fields are mapped to character number sequences through a predefined character table, and then truncated or padded to a fixed length. The character number sequence is converted into an embedding vector sequence using a character embedding matrix, and the embedding vector sequence is pooled to generate a fixed-length string representation. The fixed-length string is concatenated with the corresponding numerical features, security rule features, and asset context features to generate the original node features.

[0098] Optionally, the temporal heterogeneity graph construction module is also used for: The network transmission-related attributes and terminal operation-related attributes in the target behavior data are concatenated into edge attribute features.

[0099] Optionally, the network includes a feature compression unit and a quantum feature encoding unit; The feature compression unit is used to: reduce the dimension of node features and edge attribute features to a unified low-dimensional space through linear projection, and compress the time-coded features to the unified low-dimensional space through linear projection. The quantum feature encoding unit is used to: map the compressed node features, edge attribute features, and time encoding features to the corresponding node quantum states, edge quantum states, and time quantum states respectively through angle encoding; and to map the relation type to the relation type quantum state through independent encoding lines.

[0100] Optionally, the network includes a multi-layered quantum-classical hybrid graph attention layer and a risk prediction layer connected in sequence; Each quantum-classical hybrid graph attention layer is used to perform quantum attention aggregation on the temporal neighbor information of each target node in the temporal heterogeneous graph, and output the current update representation of each target node; wherein, the current update representation output by the last quantum-classical hybrid graph attention layer is used as the target update representation; The risk prediction layer is used to generate an anomaly risk score based on the target update representation in order to determine whether the terminal to be detected has any security operation risks.

[0101] Optionally, the quantum-classical hybrid graph attention layer includes a multi-head quantum attention computation unit, a neighbor quantum information aggregation unit, and a relation-level fusion unit; The multi-head quantum attention computing unit is used to construct multiple attention heads with multiple sets of independently parameterized quantum circuits to calculate in parallel the quantum attention weights of each temporal neighbor information for the target node under each relation type; the neighbor quantum information aggregation unit is used to perform weighted aggregation of the temporal neighbor information under each relation type based on each quantum attention weight to generate a neighbor aggregation representation for the relation type; the relation-level fusion unit is used to determine the relation attention weights of the neighbor aggregation representations corresponding to each relation type, and perform weighted aggregation of each neighbor aggregation representation based on each relation attention weight to generate the current updated representation of the target node.

[0102] Optionally, the quantum-classical hybrid graph attention layer includes relation-conditionally parameterized quantum circuit units; The relation condition parameterized quantum circuit unit is used to perform quantum evolution on the quantum state associated with the temporal neighbor information according to the relation condition parameterized quantum circuit corresponding to each relation type, and generate relation enhancement quantum state; The multi-head quantum attention computing unit calculates the quantum attention weights based on the relationship-enhanced quantum state.

[0103] Optionally, the quantum attention weights are obtained in the following way: The Pauli-Z observable is measured on the relation-enhancing quantum state to obtain the quantum attention score of each temporal neighbor information for the target node; The quantum attention scores of each temporal neighbor are normalized within the temporal neighbor set of the same relation type to obtain the quantum attention weights.

[0104] Optionally, the risk prediction layer includes a quantum measurement reading unit, a risk probability determination unit, and a risk judgment unit; The quantum measurement and reading unit is used to generate a risk feature vector based on the target update representation corresponding to each target node; The risk probability determination unit is used to determine the risk probability corresponding to each attack type and determine the abnormal risk score based on the risk feature vector and a classifier. The risk assessment unit is used to determine that the terminal to be detected has a security operation risk when the abnormal risk score is greater than a preset risk threshold, and to determine the attack type corresponding to the maximum risk probability as the security operation risk type.

[0105] Optionally, the risk judgment unit is used to determine the abnormal risk score, the attack type corresponding to the maximum risk probability, and the maximum risk probability as candidate security events when the abnormal risk score exceeds a preset risk threshold.

[0106] Optionally, the preset context association rules include preset attack phase association rules and an event confirmation module, used for: Obtain the context information of the candidate security event, wherein the context information includes at least one of the following: terminal identifier, process chain, network connection record, file operation record, and historical alarm record; The attack chain integrity of the candidate security event is verified based on the context information. When the candidate security event and the context information satisfy the preset attack stage association rule, the candidate security event is confirmed as a security event.

[0107] Optionally, the device further includes: The information sending module is used to generate a security event alarm message after confirming that the candidate security event is a security event, and to send the security event alarm message to the first instant messaging software client corresponding to the security operations personnel, and to send a security risk warning message to the second instant messaging software client corresponding to the user to which the terminal to be detected belongs.

[0108] Optionally, the device further includes: The feedback information acquisition module is used to acquire feedback information submitted by the security operations personnel through the first instant messaging software client in response to the security event alarm message; An incremental training sample generation module is used to annotate the associated information corresponding to the candidate security event based on the feedback information, generate incremental training samples, and store the incremental training samples in an incremental learning buffer; wherein, the associated information includes a snapshot of the temporal heterogeneous graph corresponding to the candidate security event, a candidate event subgraph, quantum encoded features, quantum attention weights, and relational attention weights; The network incremental update module is used to incrementally update the network based on each of the incremental training samples in the incremental learning buffer when the number of incremental training samples in the incremental learning buffer reaches a preset batch size or a preset timed trigger condition is reached.

[0109] The terminal security operation alarm device provided in this application embodiment can execute a terminal security operation alarm method provided in any embodiment of this application, and has the corresponding functional modules and beneficial effects of the execution method.

[0110] Figure 6 A schematic diagram of the structure of a terminal security operation alarm system 10, which can be used to implement embodiments of this application, is shown. The terminal security operation alarm system is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The terminal security operation alarm system can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the application described and / or claimed herein.

[0111] like Figure 6 As shown, the terminal security operation alarm system 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the terminal security operation alarm system 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0112] Multiple components in the endpoint security operation alarm system 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, optical disk, etc.; and a communication unit 19, such as a network card, modem, wireless transceiver, etc. The communication unit 19 allows the endpoint security operation alarm system 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0113] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as endpoint security operation alarm methods.

[0114] In some embodiments, the endpoint security operation alarm method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed onto the endpoint security operation alarm system 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the endpoint security operation alarm method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the endpoint security operation alarm method by any other suitable means (e.g., by means of firmware).

[0115] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0116] Computer programs used to implement the methods of this application may be written in any combination of one or more programming languages. These computer programs may be provided to the processor of a general-purpose computer, special-purpose computer, or other programmable terminal security operation alarm device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0117] In the context of this application, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0118] To provide user interaction, the systems and techniques described herein can be implemented on a terminal security operation alarm system, which includes: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the terminal security operation alarm system. Other types of devices can also be used to provide user interaction; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including voice input, speech input, or tactile input).

[0119] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0120] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through a communication network. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0121] This invention also provides a computer program product, including a computer program that, when executed by a processor, implements the terminal security operation alarm method provided in any embodiment of this application.

[0122] In implementing the computer program product, computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or it can be connected to an external computer (e.g., via the Internet using an Internet service provider). It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired information of the technical solution of this application can be achieved, and this is not limited herein.

[0123] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A terminal security operation alarm method, characterized in that, The method includes: Acquire the behavioral data of the terminal to be tested, and use it as target behavioral data; The target behavior data is parsed to extract structured fields, and a temporal heterogeneous graph is constructed based on the structured fields; the nodes of the temporal heterogeneous graph at least represent terminal entities, the edges represent terminal behaviors between entities, and are associated with time attributes; The temporal heterogeneous graph is input into a quantum-classical hybrid temporal heterogeneous graph attention network. The network compresses and encodes the classical features of the temporal heterogeneous graph into quantum states. The quantum attention weights of each temporal neighbor node to the target node are calculated using parameterized quantum circuits. The quantum enhancement features of each temporal neighbor node are aggregated according to the quantum attention weights to obtain the updated representation of the target node. Candidate security events are output based on the updated representation. The candidate security events are confirmed according to preset context association rules, and a confirmed security event is generated when the confirmation is successful.

2. The method according to claim 1, characterized in that, The analysis includes: For string fields in the target behavior data, the string fields are mapped to character number sequences through a predefined character table, and then truncated or padded to a fixed length. The character number sequence is converted into an embedding vector sequence using a character embedding matrix, and the embedding vector sequence is pooled to generate a fixed-length string representation. The fixed-length string is concatenated with the corresponding numerical features, security rule features, and asset context features to generate the original node features.

3. The method according to claim 2, characterized in that, The analysis also includes: The network transmission-related attributes and terminal operation-related attributes in the target behavior data are concatenated into edge attribute features.

4. The method according to claim 1, characterized in that, The network includes a feature compression unit and a quantum feature encoding unit; The feature compression unit is used to: reduce the dimension of node features and edge attribute features to a unified low-dimensional space through linear projection, and compress the time-coded features to the unified low-dimensional space through linear projection. The quantum feature encoding unit is used to: map the compressed node features, edge attribute features, and time encoding features to the corresponding node quantum states, edge quantum states, and time quantum states respectively through angle encoding; and to map the relation type to the relation type quantum state through independent encoding lines.

5. The method according to claim 4, characterized in that, The network comprises sequentially connected multi-layer quantum-classical hybrid graph attention layers and risk prediction layers; Each quantum-classical hybrid graph attention layer is used to perform quantum attention aggregation on the temporal neighbor information of each target node in the temporal heterogeneous graph, and output the current update representation of each target node; wherein, the current update representation output by the last quantum-classical hybrid graph attention layer is used as the target update representation; The risk prediction layer is used to generate an anomaly risk score based on the target update representation in order to determine whether the terminal to be detected has any security operation risks.

6. The method according to claim 5, characterized in that, The quantum-classical hybrid graph attention layer includes a multi-head quantum attention computation unit, a neighbor quantum information aggregation unit, and a relation-level fusion unit; The multi-head quantum attention computing unit is used to construct multiple attention heads with multiple sets of independently parameterized quantum circuits, and to calculate in parallel the quantum attention weights of each temporal neighbor information for the target node under each relation type. The neighbor quantum information aggregation unit is used to perform weighted aggregation of temporal neighbor information under each relation type based on each quantum attention weight, and generate a neighbor aggregation representation of the relation type; The relation-level fusion unit is used to determine the relation attention weights of the neighbor aggregation representations corresponding to each relation type, and to perform weighted aggregation on each neighbor aggregation representation based on each relation attention weight to generate the current updated representation of the target node.

7. The method according to claim 6, characterized in that, The quantum-classical hybrid graph attention layer contains relation-conditionally parameterized quantum circuit units; The relation condition parameterized quantum circuit unit is used to perform quantum evolution on the quantum state associated with the temporal neighbor information according to the relation condition parameterized quantum circuit corresponding to each relation type, and generate relation enhancement quantum state; The multi-head quantum attention computing unit calculates the quantum attention weights based on the relationship-enhanced quantum state.

8. The method according to claim 7, characterized in that, The quantum attention weights are obtained in the following way: The Pauli-Z observable is measured on the relation-enhancing quantum state to obtain the quantum attention score of each temporal neighbor information for the target node; The quantum attention scores of each temporal neighbor are normalized within the temporal neighbor set of the same relation type to obtain the quantum attention weights.

9. The method according to claim 7, characterized in that, The risk prediction layer includes a quantum measurement and reading unit, a risk probability determination unit, and a risk judgment unit; The quantum measurement and reading unit is used to generate a risk feature vector based on the target update representation corresponding to each target node; The risk probability determination unit is used to determine the risk probability corresponding to each attack type and determine the abnormal risk score based on the risk feature vector and a classifier. The risk judgment unit is used to determine that the terminal to be detected has a security operation risk when the abnormal risk score is greater than a preset risk threshold, and to determine the attack type corresponding to the maximum risk probability as the security operation risk type.

10. The method according to claim 9, characterized in that, The risk assessment unit is used to determine the abnormal risk score, the attack type corresponding to the maximum risk probability, and the maximum risk probability as candidate security events when the abnormal risk score exceeds a preset risk threshold.

11. The method according to claim 9, characterized in that, The preset context association rules include preset attack phase association rules, and the step of confirming the candidate security events according to the preset context association rules includes: Obtain the context information of the candidate security event, wherein the context information includes at least one of the following: terminal identifier, process chain, network connection record, file operation record, and historical alarm record; The attack chain integrity of the candidate security event is verified based on the context information. When the candidate security event and the context information satisfy the preset attack stage association rule, the candidate security event is confirmed as a security event.

12. The method according to claim 11, characterized in that, The method further includes: After confirming that the candidate security event is a security event, a security event alarm message is generated and sent to the first instant messaging software client corresponding to the security operations personnel, and a security risk warning message is sent to the second instant messaging software client corresponding to the user to which the terminal to be detected belongs.

13. The method according to claim 12, characterized in that, The method further includes: Obtain feedback information regarding the security incident alarm message submitted by the security operations personnel through the first instant messaging software client; Based on the feedback information, the association information corresponding to the candidate security event is annotated to generate incremental training samples, and the incremental training samples are stored in the incremental learning buffer; wherein, the association information includes the temporal heterogeneous graph snapshot, candidate event subgraph, quantum coding features, quantum attention weights and relational attention weights corresponding to the candidate security event; When the number of incremental training samples in the incremental learning buffer reaches a preset batch size or a preset timed trigger condition is met, the network is incrementally updated based on each of the incremental training samples in the incremental learning buffer.

14. A terminal security operation alarm device, characterized in that, include: The target behavior data acquisition module is used to acquire the behavior data of the terminal to be detected, as the target behavior data; The temporal heterogeneous graph construction module is used to parse the target behavior data, extract structured fields, and construct a temporal heterogeneous graph based on the structured fields. The nodes of the temporal heterogeneous graph at least represent terminal entities, the edges represent terminal behaviors between entities, and are associated with time attributes. The quantum-enhanced inference module is used to input the temporal heterogeneous graph into a quantum-classical hybrid temporal heterogeneous graph attention network, so that the classical features of the temporal heterogeneous graph are compressed and encoded into quantum states by the network. The quantum attention weights of each temporal neighbor node to the target node are calculated using parameterized quantum circuits. The quantum-enhanced features of each temporal neighbor node are aggregated according to the quantum attention weights to obtain the updated representation of the target node, and candidate security events are output based on the updated representation. The event confirmation module is used to confirm the candidate security events according to preset context association rules, and generate a confirmed security event when the confirmation is successful.

15. A terminal security operation alarm system, characterized in that, The terminal security operation alarm system includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the terminal security operation alarm method according to any one of claims 1-13.

16. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that are used to cause a processor to execute the terminal security operation alarm method according to any one of claims 1-13.

17. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the terminal security operation alarm method according to any one of claims 1-13.

Images