Provenance graph-oriented host-based intrusion detection method and system, and storage medium

Abstract

The present invention relates to the field of network security. Disclosed are a provenance graph-oriented host-based intrusion detection method and system, and a storage medium. The method comprises: S1, collecting provenance data of a host to be detected, so as to construct a provenance graph representing a user behavior; S2, mapping nodes in the provenance graph into roles, constructing a node feature matrix of which feature vectors are used for representing attribute features and structural features of the nodes in the provenance graph and an interaction relationship between the nodes, and mapping the nodes having similar feature vectors into the same role; S3, performing attention-based attributed and temporal random walk in comprehensive consideration of the attributes of the nodes in the provenance graph, a temporal relationship between edges of the nodes, and attention parameters between different roles; and S4, converting an obtained attributed and temporal random walk sequence into an embedded vector to extract a feature of the provenance graph, and performing intrusion anomaly detection. The present invention can implement deep representation learning on provenance data, reduce the workload of detection model training, and improve the accuracy and efficiency of intrusion detection.

Description

A host intrusion detection method, system and storage medium oriented to traceability graph

Technical field

[0001] The present invention belongs to the field of network security technology, and more specifically, relates to a host intrusion detection method, system and storage medium oriented to a traceability graph. [Background Technology]

[0002] Intrusion detection is a core technology in network security. It analyzes and utilizes information collected from computer systems and networks (such as network traffic and host logs) to determine whether the system or network has experienced abnormal behavior that violates security policies or is under attack. As a proactive protection technology, intrusion detection plays a vital role in protecting network and system security.

[0003] Traditional host intrusion detection methods typically use system calls or logs as data sources to analyze and identify host intrusions. However, these methods are easily bypassed by attackers due to inherent flaws in their data sources (system calls / logs), resulting in low detection accuracy. Provenance-based host intrusion detection uses provenance data as its data source. Provenance data describes system data objects (processes, files, sockets, pipes) and the complex dependencies between these data objects, providing a complete structured view of events occurring on the system or network. Presented as a directed acyclic graph (provenance graph), this data fundamentally enhances detection accuracy and robustness.

[0004] Traditional host intrusion detection methods based on traceability use general graph embedding models (such as DeepWalk, Node2Vec, GraphSAGE) or graph kernel algorithms (such as Weisfeiler-Lehma) to perform representation learning on traceability graph data to obtain embedding vectors, and perform intrusion detection based on the data features represented by the embedding vectors. This method can only perform shallow representation learning on traceability, and the data features obtained are limited. As user behavior gradually becomes more diversified and attackers' attack methods become more complicated, the embedding vectors obtained based on this general model or algorithm have a relatively simple representation of traceability data features. This shallow representation learning also does not take into account the specific application scenarios and required data characteristics of intrusion detection, resulting in poor representation learning effects. When applied to intrusion detection, the detection efficiency is low. At the same time, it also requires a lot of manpower and time to adjust and train the detection model.

[0005] [Summary of the invention]

[0006] In response to the defects of the existing technology and the need for improvement, the present invention provides a host intrusion detection method, system and storage medium for tracing back graphs, the purpose of which is to improve the accuracy and efficiency of intrusion detection based on tracing back graph data.

[0007] To achieve the above objectives, according to a first aspect of the present invention, a host intrusion detection method based on a traceability graph is provided, comprising:

[0008] S1. Collect traceability data of the host to be tested to build a traceability graph representing user behavior;

[0009] S2. Mapping the nodes in the traceability graph to roles, constructing a node feature matrix whose feature vectors are used to characterize the attribute features, structural features, and interaction relationships between the nodes in the traceability graph, and mapping nodes with similar feature vectors in the node feature matrix to the same role;

[0010] S3, perform attribute temporal random walk with attention, generate the current node v i As the starting point, the attribute time series random walk sequence of length L is: x i is node v i The eigenvector of ; φ(x) represents the function that maps nodes to roles; where, 1<<t<<L and For nodes With the next node The edges connecting them; E T are all the edges in the traceability graph; t is the sequence number in the walk sequence; Representation node The edge between them is created earlier than the node The creation time of the edge between them;

[0011] The current node moves to neighboring nodes corresponding to different roles with different probabilities; the probability is the attention parameter between the roles, which is used to reflect the importance between the roles;

[0012] S4. Convert the attribute temporal random walk sequence into an embedding vector to extract the traceability graph features and perform intrusion anomaly detection.

[0013] Furthermore, in S3, the attention parameters between the roles are represented by a role attention matrix M, and the acquisition method of the role attention matrix M includes:

[0014] S301, setting equal transfer probability as the current role attention matrix M;

[0015] S302, use the current role attention matrix M to perform attribute temporal random walk with attention, and obtain the current node v i The embedding vector e i And the embedding vectors e corresponding to all neighbor nodes of the current node N ;

[0016] S303, using the embedding vector e i and e N Update the current character attention matrix M:

[0017] Among them, softmax represents the normalization operator; w i Represents the current node v i The corresponding role, w j Represents the current node v i The elements in the role set corresponding to all neighbor nodes of δ(w j ,w i ) represents w j Role vs. i Importance of the role; i is the current node v i The corresponding embedding vector; Indicates the neighbor nodes that belong to role w j The mean function is used to aggregate the embedding vectors corresponding to the same type of roles in the sequence;

[0018] S304. Repeat S302 and S303 until the role attention matrix M tends to be stable, and the required role attention matrix M is obtained.

[0019] Furthermore, in S304, by calculating the distance between the two character attention matrices obtained from two adjacent iterations, the number of character transition probability changes exceeding a set first threshold is obtained. If the number is less than a set second threshold, the character attention matrix M tends to be stable.

[0020] Furthermore, in S4, the attribute time series random walk sequence is input into the SkipGram model to calculate the embedding vector of each node.

[0021] Furthermore, in S4, the embedding vector is input into a pre-trained intrusion detection model to perform intrusion anomaly detection.

[0022] Furthermore, the function φ(x) for mapping nodes to roles is a binary operator or a k-means clustering function.

[0023] Furthermore, in S1, after collecting the traceability data of the host to be tested, the process also includes filtering the traceability data that is not related to the intrusion behavior and removing nodes with the same attribute characteristics.

[0024] Furthermore, the nodes in the traceability graph are used to represent data objects of the host to be tested, and the data objects include processes, files, sockets and pipes.

[0025] According to another aspect of the present invention, a host intrusion detection system oriented to a traceability graph is provided, for executing the method according to any one of the first aspects, the system comprising:

[0026] The traceability graph construction module is used to collect traceability data of the host under test to build a traceability graph representing user behavior;

[0027] A role mapping module is used to map nodes in the traceability graph to roles, construct a node feature matrix whose feature vectors are used to characterize the attribute features, structural features, and interaction relationships between nodes in the traceability graph, and map nodes with similar feature vectors in the node feature matrix to the same role;

[0028] Random walk module, used to perform attribute temporal random walk with attention, generating i As the starting point, the attribute time series random walk sequence of length L is: x i is node v i The eigenvector of ; φ(x) represents the function that maps nodes to roles; where, 1<<t<<L and For nodes With the next node The edges connecting them; E T are all the edges in the traceability graph; t is the sequence number in the walk sequence; Representation node The edge between them is created earlier than the node The creation time of the edge between them;

[0029] The current node moves to neighboring nodes corresponding to different roles with different probabilities; the probability is the attention parameter between the roles, which is used to reflect the importance between the roles;

[0030] The anomaly detection module is used to convert the attribute time series random walk sequence into an embedding vector to extract the traceability graph features and perform intrusion anomaly detection.

[0031] According to another aspect of the present invention, a computer-readable storage medium is provided, comprising a stored computer program; when the computer program is executed by a processor, the device where the computer-readable storage medium is located is controlled to execute the host intrusion detection method oriented to the traceability graph as described in any one of the first aspects.

[0032] In general, the above technical solutions conceived by the present invention can achieve the following beneficial effects:

[0033] (1) The host intrusion detection method for the traceability graph of the present invention, in the process of performing the attribute temporal random walk with attention, takes into account that the data in the traceability intrusion detection scenario has temporal characteristics, that is, the relationship and behavior between nodes occur in chronological order. The constructed walk strategy can capture the time evolution relationship between nodes by considering the temporal characteristics of the traceability graph edges, so that the obtained embedding vector can represent the dynamic characteristics of the intrusion behavior; at the same time, nodes of different roles have different behaviors and characteristics in the traceability graph. In the process of performing the random walk, considering the influence of the neighbor nodes of different roles on the embedding, the interaction pattern and information transmission between nodes can be better captured, and the perception and understanding ability of the behavioral characteristics of different roles can be improved, so as to more accurately distinguish normal behavior from potential intrusion behavior, so that the final embedded vector can provide more accurate features for tasks such as node classification, node clustering, and node similarity calculation, thereby realizing the deep representation of the traceability data and improving the accuracy of intrusion detection.

[0034] The method of the present invention maps nodes with similar attribute characteristics, structural characteristics and interaction relationships in the node feature matrix into the same role. Through role mapping, a large number of nodes can be summarized into a group of roles with similar characteristics and behavior patterns, reducing the complexity of information, thereby simplifying the intrusion detection process, reducing the number of nodes that need to be analyzed, and improving the efficiency of intrusion detection.

[0035] (2) The method of the present invention can better identify the behavior patterns between nodes after role mapping of the traceability data, facilitate the discovery of abnormal behaviors and unusual interaction patterns, and utilize the behavioral characteristics and interaction methods of the roles so that nodes with similar characteristics and behavior patterns will have similar embedding vectors even if they are far apart in the traceability graph. When performing intrusion detection, it can fully explore the association between node features and realize the effective extraction of traceability graph node features for intrusion behavior. It is also convenient to provide more accurate features for subsequent tasks such as node classification, node clustering, and node similarity calculation, thereby further improving the accuracy and efficiency of intrusion detection.

[0036] (3) As a preference, extracting effective traceability information through preprocessing such as filtering and compression can further improve the efficiency of intrusion detection.

[0037] In summary, the present invention can effectively solve the problem that existing traceability intrusion detection technology is difficult to perform deep representation learning on the increasingly growing and complex traceability data, reduce the workload of detection model training, and improve the accuracy and efficiency of intrusion detection.

Brief Description of the Drawings

[0038] FIG1 is a flow chart of a host intrusion detection method oriented to a traceability graph according to the present invention.

[0039] FIG2 is a schematic diagram of constructing a node feature matrix based on a traceability graph provided by an embodiment of the present invention.

[0040] FIG3 is a schematic diagram of the steps for updating the character attention matrix provided by an embodiment of the present invention.

[0041] Figure 4 is a schematic diagram of the node vector embedding process based on the attribute temporal random walk with attention provided in an embodiment of the present invention; wherein, (a)-(d) in Figure 4 respectively represent different stages of the attribute temporal random walk with attention on the node. [Specific implementation method]

[0042] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only intended to illustrate the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below may be combined with each other as long as they do not conflict with each other.

[0043] In the present invention, the terms "first", "second", etc. in the present invention and the accompanying drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0044] As shown in FIG1 , the host intrusion detection method for the traceability graph of the present invention mainly includes:

[0045] S1. Collect the traceability data of the host to be tested and use the traceability data to build a traceability graph representing user behavior.

[0046] S2. Construct a node feature matrix based on the attribute characteristics, structural characteristics and interaction relationships between nodes in the traceability graph; and map all nodes to roles through the role mapping function, and map nodes with similar attribute characteristics, structural characteristics and interaction relationships between nodes in the node feature matrix to the same role; wherein, the nodes in the traceability graph are used to represent data objects such as processes, files, sockets and pipes; the structural characteristics of the nodes are used to represent the graph position information of the nodes, and the interaction relationship between nodes is the behavior pattern of the nodes, which is used to represent the interaction relationship between the current node and other nodes.

[0047] S3, perform attribute temporal random walk with attention, generate the current node v i As the starting point, the attribute time series random walk sequence of length L is: x i is node v iThe k-dimensional feature vector of the node is used to represent the attribute characteristics, structural characteristics and interaction relationship between the node and its adjacent nodes; φ(x) represents the function that maps the node with feature vector x to a role, φ:x→w, where x represents the k-dimensional feature vector corresponding to the node and w represents the role corresponding to the node;

[0048] in, 1<<t<<L and Represents a node in the traceability graph and its next node The edges connecting them; E T represents all the edges in the traceability graph; t represents the sequence number in the walk sequence; Τ() represents the time when the edge between two nodes is established; Representation node The edge between them is created earlier than the node Moreover, during the random walk, the probability of the current node walking to the neighboring nodes corresponding to different roles is determined by the attention parameters between the roles.

[0049] S4. Convert the obtained attribute temporal random walk sequence into an embedding vector to extract features from the traceability graph for intrusion detection.

[0050] Specifically, in S1, the traceability collection system is used to intercept the system calls of the host under test and generate traceability data that records user behavior. The traceability data can provide a complete structured view of events occurring on the system by describing system data objects (processes, files, sockets, pipes, etc.) and the complex dependencies between data objects, and is presented as a directed acyclic graph (traceability graph).

[0051] In the embodiment of the present invention, systems such as SPADE and Camflow are used to collect traceability information of system kernels, file formats, and applications that record user behaviors.

[0052] Preferably, S1 further includes preprocessing the collected traceability data to filter out traceability information unrelated to the intrusion behavior, remove nodes with identical attribute information, and filter out redundant information unrelated to intrusion detection, such as temporary files and environment variables. Effective traceability information is extracted through preprocessing such as filtering and compression to improve detection efficiency.

[0053] Specifically, as shown in Figure 2, in S2, the node attributes include the node's type, id, timestamp, version, and other attributes. Each row or column in the node feature matrix represents a k-dimensional feature vector corresponding to a node, including the node's attribute features, structural features, and the interactions between nodes.

[0054] In the embodiment of the present invention, taking the traceability graph having five nodes A, B, C, D, and E as an example, the node feature matrix X after conversion is shown in FIG2 .

[0055] In S2, the role mapping function φ can be obtained by learning or manually defining. In an embodiment of the present invention, the role mapping function φ is defined as a binary operator; in other embodiments, the role mapping function φ can also be defined as a k-means clustering function.

[0056] At the same time, if the characteristics and behavior patterns are the same within a set error range, they are considered to have similar characteristics and behavior patterns. In the embodiment of the present invention, all traceability graph nodes are mapped to n types of roles.

[0057] Specifically, as shown in Figure 3, in S3, the attention parameters between roles, that is, the importance between different roles, are represented by the role attention matrix. The role attention matrix learns the optimal adaptive attention parameters between roles through iterative training and updating, including:

[0058] S301, setting equal transfer probability as the current role attention matrix M;

[0059] S302, using the current role attention matrix M to perform attribute temporal random walk with attention, and obtain the current node v i As the starting point, the attribute time series random walk sequence l with attention of length L is input into the SkipGram model to calculate the current node v i The embedding vector e i And the embedding vectors e corresponding to all neighbor nodes of the current node N , where N represents the node v i The set of all neighbor nodes of i and e N Update the character attention matrix M;

[0060] S304. Repeat S302 and S303 until the character attention matrix M tends to be stable, and the required character attention matrix M is obtained.

[0061] Specifically, in S303, the embedding vector e is used i and e N Update the character attention matrix M as follows:

[0062] Among them, softmax represents the normalization operator; w i Represents the current node v i The corresponding role, wj Represents the current node v i The role set R corresponding to all neighbor nodes i w in j element;δ(w j ,w i ) represents w j Role vs. i Importance of the role; i is the current node v i The corresponding embedding vector, e N is the embedding vector corresponding to all neighbor nodes of the current node; Indicates the neighbor nodes that belong to role w j The mean function of the average aggregator is used to aggregate the embedding vectors corresponding to the same type of roles in the attribute time series random walk sequence with attention.

[0063] M ij It takes values ​​between [0,1], where each element represents the role w i The current node v i Wander to the character you belong to j The probability of neighbor nodes.

[0064] Specifically, in S304, the node transition probability change is obtained by recording the distance (calculating the difference) between the two character attention matrices obtained after two adjacent iterative updates, and the number of node transition probability changes greater than a set first threshold is recorded. If the number is less than a set second threshold, it indicates that the character attention matrix M has stabilized, the iterative update is stopped, and the desired character attention matrix M is obtained. In this embodiment of the present invention, the first threshold is set to 0.05, and the second threshold is the proportion of node changes, which is set to 10%.

[0065] Specifically, after completing the role mapping in S2 and the attention matrix update step in S3, an attentive attribute temporal random walk is performed on all nodes to obtain a walk node role sequence, and then the final embedding vector is obtained through the SkipGram model. In this embodiment of the present invention, the process of obtaining the embedding vector of node v1 based on the attentive attribute temporal random walk is used as an example to illustrate the present invention. As shown in (a) of Figure 4, first, all nodes in the traceability graph are mapped into four role types (role 1 to role 4) through role mapping; then, the temporal relationship of node edges and the attention parameters between different roles are comprehensively considered, as shown in (b) of Figure 4, where t represents the time when the edge is generated and α represents the attention parameter; then, a random walk is performed starting from node v1, and the role set corresponding to the neighbor nodes of node v1 is N = {role 2, role 1}, where the attention parameter between role 2 belonging to node v1 and role 2 corresponding to the neighbor nodes of node v1 is 0.25, and the attention parameter between role 2 belonging to node v1 and role 1 corresponding to the neighbor nodes of node v1 is 0.75; by setting the random walk length to 3 and the number of walks to 4, in an ideal state, node v1 will walk to the neighbor nodes corresponding to role 1 3 times and to the neighbor nodes corresponding to role 2 once, and the resulting random walk sequence is shown in (c) of Figure 4; finally, the embedding vector is obtained through the SkipGram model, as shown in (d) of Figure 4.

[0066] Specifically, in S4, the obtained embedding vector is input into the pre-trained intrusion detection model to perform intrusion anomaly detection.

[0067] Among them, the embedding vector is used to reflect the current node v i The similarity between the corresponding role and the role corresponding to its neighbor node. The higher the similarity, the more the role of the neighbor node is related to the current node v. i The more important.

[0068] The host intrusion detection method for the source traceability graph of the present invention is to detect the host intrusion by using the current node v i Taking the time sequence of the traceability graph as the starting point, the attribute temporal random walk with attention is carried out. Considering that the data in the traceability intrusion detection scenario has temporal sequence, that is, the relationship and behavior between nodes occur in chronological order, the constructed walk strategy can capture the time evolution relationship between nodes by considering the temporal sequence of the traceability graph edges, so that the obtained embedding vector can represent the dynamic characteristics of the intrusion behavior.

[0069] At the same time, the constructed wandering strategy takes into account the influence of the role's neighbor nodes on the wandering of the current node. Nodes of different roles have different behaviors and characteristics in the traceability graph. Considering the influence of neighbor nodes of different roles on embedding, the interaction patterns and information transmission between nodes can be better captured, and the ability to perceive and understand the behavioral characteristics of different roles can be improved, thereby more accurately distinguishing normal behaviors from potential intrusion behaviors, thereby improving the efficiency of intrusion detection based on traceability graph data.

[0070] That is, the method of the present invention simultaneously considers the temporal sequence of the traceability graph edges and the influence of neighbor nodes of different roles on the embedding, better captures the temporal characteristics of intrusion behavior, and improves the perception of time correlation; modeling is performed on neighbor nodes of different roles to enhance the perception and understanding of the behavioral characteristics of different roles. The final embedding vector can provide more accurate features for tasks such as node classification, node clustering, and node similarity calculation, thereby improving the accuracy of the intrusion detection system.

[0071] The method of the present invention maps nodes with similar attribute characteristics, structural characteristics and interaction relationships in the node feature matrix into the same role. Through role mapping, a large number of nodes can be summarized into a group of roles with similar characteristics and behavior patterns, reducing the complexity of information, thereby simplifying the intrusion detection process and reducing the number of nodes that need to be analyzed.

[0072] The traceability data after role mapping can better identify the behavior patterns between nodes, facilitate the discovery of abnormal behaviors and unusual interaction patterns, and utilize the behavioral characteristics and interaction methods of the roles so that nodes with similar characteristics and behavior patterns will have similar embedding vectors even if they are far apart in the traceability graph. When performing intrusion detection, it can fully explore the association between node features and realize the effective extraction of traceability graph node features for intrusion behavior. It is also convenient to provide more accurate features for subsequent tasks such as node classification, node clustering, and node similarity calculation, thereby further improving the accuracy and efficiency of intrusion detection.

[0073] Mapping to roles can provide an understanding of the structural characteristics of the node's graph position, facilitate the analysis of how the node's behavior and interaction are integrated into the entire graph structure, help detect abnormal graph structures and node positions, and improve the ability to perceive intrusion behavior.

[0074] In addition, role mapping makes the results of intrusion detection easier to understand and interpret. Different roles represent different behaviors and characteristics. Compared with node information, it can provide more intuitive intrusion detection output and facilitate visualization of the behaviors and relationships of different roles in the traceability graph, helping analysts better understand and evaluate potential intrusion behaviors.

[0075] In summary, mapping attribution information to a role can simplify complexity, improve pattern recognition, facilitate context modeling, and enhance explainability and visualization. These improvements help improve the accuracy, efficiency, and understandability of intrusion detection, leading to more effective detection and response to potential intrusions.

[0076] According to another aspect of the present invention, a host intrusion detection system oriented to a traceability graph is provided, which is configured to execute the steps corresponding to the host intrusion detection method oriented to a traceability graph in the above embodiment. The system includes:

[0077] The traceability graph construction module is used to collect traceability data of the host under test to build a traceability graph representing user behavior;

[0078] The role mapping module is used to map nodes in the traceability graph to roles, construct a node feature matrix whose feature vectors are used to represent the attribute characteristics, structural characteristics and interaction relationships of nodes in the traceability graph, and map nodes with similar feature vectors in the node feature matrix to the same role;

[0079] Random walk module, used to perform attribute temporal random walk with attention, generating i As the starting point, the attribute time series random walk sequence of length L is: x i is node v i The eigenvector of ; φ(x) represents the function that maps nodes to roles; where, 1<<t<<L and For nodes With the next node The edges connecting them; E T are all the edges in the traceability graph; t is the sequence number in the walk sequence; Representation node The edge between them is created earlier than the node The creation time of the edge between them; and the current node moves to the neighboring nodes corresponding to different roles with different probabilities; the probability is the attention parameter between roles, which is used to reflect the importance between roles;

[0080] The anomaly detection module is used to convert the attribute time series random walk sequence into an embedding vector to extract the traceability graph features and perform intrusion anomaly detection.

[0081] According to another aspect of the present invention, a computer-readable storage medium is provided, comprising a stored computer program; when the computer program is executed by a processor, the device where the computer-readable storage medium is located is controlled to execute the host intrusion detection method oriented to the traceability graph in the above-mentioned embodiment.

[0082] The attribute temporal random walk strategy with attention in the present invention is a random walk proposed for the scenario of traceability intrusion detection. It comprehensively mines the attributes, temporal relationships and weights of the current node walking to the corresponding roles of its neighboring nodes of the traceability graph. The final embedded vector can provide more accurate features for tasks such as node classification, node clustering, and node similarity calculation, realizing deep representation of traceability data and improving the accuracy of the intrusion detection system. At the same time, it also avoids the need to adjust and train the intrusion detection model when performing intrusion detection.

[0083] It will be easily understood by those skilled in the art that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A host intrusion detection method oriented to a traceability graph, characterized in that: include: S1. Collect the traceability data of the host to be tested to build a traceability graph representing user behavior; S2, mapping the nodes in the traceability graph to roles, constructing a node feature matrix whose feature vectors are used to characterize the attribute features, structural features and interaction relationships between the nodes in the traceability graph, and mapping the nodes with similar feature vectors in the node feature matrix to the same role; S3, perform an attribute temporal random walk with attention, and generate i As the starting point, the attribute time series random walk sequence of length L is: x i is node v i The feature vector of ; φ(x) represents the function that maps nodes to roles; where, 1<<t<<L and For Node With the next node The edges connecting them; E T are all the edges in the traceability graph; t is the sequence number in the walk sequence; Representation Node The edge between them was created earlier than the node The creation time of the edge between them; And the current node wanders to neighboring nodes corresponding to different roles with different probabilities; the probability is the attention parameter between the roles, which is used to reflect the importance between the roles; S4. Convert the attribute time series random walk sequence into an embedding vector to extract the traceability graph features and perform intrusion anomaly detection.

2. The method according to claim 1, characterized in that In S3, the attention parameters between the roles are represented by a role attention matrix M, and the acquisition method of the role attention matrix M includes: S301, setting equal transfer probability as the current role attention matrix M; S302: Use the current role attention matrix M to perform an attribute temporal random walk with attention to obtain the current node v i The embedding vector e i And the embedding vectors e corresponding to all neighbor nodes of the current node N ; S303, using the embedding vector e i and e N Update the current character attention matrix M: Among them, softmax represents the normalization operator; w i Represents the current node v i The corresponding role, w j Represents the current node v i The elements in the role set corresponding to all neighbor nodes of j ,w i ) indicates w j Role vs. i Importance of the role; i is the current node v i The corresponding embedding vector; Indicates the neighbor nodes that belong to role w j The mean function is used to aggregate the embedding vectors corresponding to the same type of roles in the sequence; S304, repeat S302 and S303 until the role attention matrix M tends to be stable, and the required role attention matrix M is obtained.

3. The method according to claim 2, characterized in that In S304, by calculating the distance between two character attention matrices obtained from two adjacent iterations, the amount by which the character's transition probability changes exceed a set first threshold is obtained. If the amount is less than a set second threshold, the character attention matrix M tends to be stable.

4. The method according to any one of claims 1 to 3, characterized in that: In S4, the attribute time series random walk sequence is input into the SkipGram model to calculate the embedding vector of each node.

5. The method according to claim 4, characterized in that In S4, the embedding vector is input into a pre-trained intrusion detection model to perform intrusion anomaly detection.

6. The method according to any one of claims 1 to 3, characterized in that: The function φ(x) for mapping nodes to roles is a binary operator or a k-means clustering function.

7. The method according to claim 1, characterized in that In S1, after collecting the traceability data of the host to be tested, it also includes: filtering the traceability data irrelevant to the intrusion behavior, and removing nodes with the same attribute characteristics.

8. The method according to claim 1, characterized in that The nodes in the traceability graph are used to represent data objects of the host to be tested, and the data objects include processes, files, sockets and pipes.

9. A host intrusion detection system for tracing graph, characterized in that: For executing the method according to any one of claims 1 to 8, the system comprises: The traceability graph construction module is used to collect the traceability data of the host to be tested to construct a traceability graph representing user behavior; A role mapping module is used to map the nodes in the traceability graph to roles, construct a node feature matrix whose feature vectors are used to characterize the attribute features, structural features and interaction relationships between the nodes in the traceability graph, and map the nodes with similar feature vectors in the node feature matrix to the same role; The random walk module is used to perform attribute temporal random walks with attention, generating i As the starting point, the attribute time series random walk sequence of length L is: x i is node v i The feature vector of ; φ(x) represents the function that maps nodes to roles; where, 1<<t<<L and For Node With the next node The edges connecting them; E T are all the edges in the traceability graph; t is the sequence number in the walk sequence; Representation Node The edge between them was created earlier than the node The creation time of the edge between them; And the current node wanders to neighboring nodes corresponding to different roles with different probabilities; the probability is the attention parameter between the roles, which is used to reflect the importance between the roles; The anomaly detection module is used to convert the attribute time series random walk sequence into an embedding vector to extract the traceability graph features and perform intrusion anomaly detection.

10. A computer-readable storage medium, characterized in that: It includes a stored computer program; when the computer program is executed by a processor, it controls the device where the computer-readable storage medium is located to execute the host intrusion detection method oriented to the traceability graph as described in any one of claims 1-8.

Images