The invention discloses an APT (
Advanced Persistent Threat)
network attack detection method based on meta-path learning and subgraph sampling, which relates to the technical field of
network security, and comprises the following steps of: constructing a network entity
relation graph, collecting and standardizing various
log data and
network topology information, and introducing an external
knowledge base to excavate a potential relation; the attribute
graph model is used for endowing rich attributes for the nodes and the edges; a meta-path is dynamically generated through an
adaptive algorithm, the meta-path is optimized in combination with frequent sub-graph mining and historical
attack data, a model in which an attention mechanism and a
noise reduction auto-
encoder are combined with a graph convolutional network is introduced, and node features are further extracted; defining a node
influence propagation index to perform sub-
graph sampling, and generating a hierarchical sub-graph; and finally, fusing sub-graph topology, nodes of meta-path learning and attribute features, and adopting multi-classifier
ensemble learning to optimize the performance of the
attack detection model. According to the method, the accuracy, timeliness and adaptability of APT
attack detection are effectively improved, and the method is suitable for a complex dynamic network environment.