The invention discloses a
lateral movement detection method and device for deploying a
time sequence perception graph neural network based on edge optimization, and the method comprises the steps: S1, capturing a host
authentication log in real time through a log collection agent deployed on edge equipment, carrying out the event filtering and key field extraction through a
rule matching engine, and forming a standardized entity
data set; s2, designing an
authentication graph structure by adopting an ontology graph
modeling language, and definitely defining node types of a user, a host, a process and the like and a
time sequence edge type containing a
timestamp and an
authentication type attribute; s3, mapping the entities into heterogeneous nodes based on a dynamic graph modeling technology, and constructing a complete transverse movement heterogeneous authentication graph through weighted
time sequence edges; s4, importing the constructed authentication graph into a lightweight
graph database Neo4j Embedded, and realizing dynamic topology maintenance by adopting an incremental
PageRank algorithm; s5, defining each identity
verification event as a multi-tuple structure, designing a
time perception sub-
graph generator, performing optimized and accelerated local neighborhood sampling by setting a time window, and generating a time sequence sub-graph sample required by training; s6, constructing a multi-scale attention coding framework, and integrating a local graph
attention network and a global Transform
encoder to realize multi-level
feature fusion; and S7, aiming at the resource limitation of the edge equipment, implementing model
cutting, a hierarchical quantification strategy and a streaming sub-graph loading mechanism, and ensuring the efficient operation of the
system in a resource-limited environment.