Cross-Host Network Attack Detection via Graph Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing complex network attack detection technologies that integrate provenance graphs and deep learning struggle with correlating attack events across multiple hosts, leading to high false alarm rates and reliance on labeled training samples, and are ineffective in detecting multi-host attacks.
Innovation Solution
A method for complex network attack detection based on cross-host abnormal behavior recognition, which involves intra-host abnormal behavior detection using graph convolution networks and autoencoders, inter-host abnormal behavior detection through sequence prediction models, and cross-host attack detection via anomaly score propagation using the PageRank algorithm.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If single-host attack detection methods are used, then detection simplicity is maintained, but detection effectiveness against complex network attacks deteriorates
Solution Approach 1:
The patent merges multiple single-host detection results into a cross-host correlation analysis system. By combining anomaly detection from multiple hosts and correlating their attack behaviors, the system achieves effective detection of complex network attacks while maintaining reasonable operational complexity through automated correlation algorithms.
Solution Approach 2:
The patent transitions from single-host detection to multi-host correlation analysis by adding the dimension of cross-host relationships. This dimensional expansion enables the detection of lateral movement patterns and coordinated attacks that cannot be detected by isolated single-host methods.
2Measurement precision
If correlation analysis of multi-host attack events is implemented, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The patent segments the complex correlation analysis into distinct modules: individual host anomaly detection, inter-host relationship analysis, and integrated correlation processing. This segmentation allows each module to handle specific tasks independently, improving accuracy while managing system complexity through modular architecture.
Solution Approach 2:
The patent introduces an intermediary correlation analysis layer that processes individual host detection results and generates integrated attack assessments. This intermediary layer simplifies the overall system by providing a standardized interface between single-host detection and multi-host correlation, reducing computational complexity.
3Ease of operation
If traditional single-point network attack methods are used, then method simplicity is maintained, but ability to detect complex attacks deteriorates
Solution Approach 1:
The patent creates a universal detection framework that can handle both simple single-host attacks and complex multi-host attacks through the same system architecture. The cross-host correlation analysis provides multi-functionality, enabling the system to detect various attack types without requiring separate specialized methods.
Data Source
AI summary
The present disclosure discloses a complex network attack detection method based on cross-host abnormal behavior recognition, and the method includes the following steps: 1) firstly collecting kernel log data of a host to construct an intra-host association graph, then employing a graph convolution network (GCN) to extract features, and finally using an autoencoder to detect abnormal nodes in the intra-host association graph; 2) firstly constructing an inter-host interaction graph by using network flow log data, then training a prediction model based on a sequence of the inter-host interaction graph, and finally detecting abnormal edges in the inter-host interaction graph according to prediction differences; and 3) firstly constructing a cross-host exception association graph according to intra-host and inter-host exception detection results, then spreading exception scores by employing a PageRank algorithm, and finally confirming an attacked host based on the exception scores.