Network Event Graph Tracing for Interpretable Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional detection methods for complex multi-step attacks are ineffective in accurately capturing and tracing the source of network threats due to the opaque nature of graph neural networks, which hinders trust in detection results and source tracing.
Innovation Solution
An attack detection and source tracing method that constructs a network event graph from entities and interaction event information, determines graph embedding vectors using a preset attack feature recognition model, and traces the source of attacks by analyzing dependencies between events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If graph neural network method is used for attack detection, then detection accuracy is improved, but interpretability and source tracing capability deteriorate
Solution Approach 1:
The patent introduces an interpretable intermediate representation layer between the graph neural network and the final detection output. This intermediate layer preserves the structural relationships in the network graph while providing human-readable explanations for detection decisions, enabling both high accuracy and source tracing capability
Solution Approach 2:
The patent segments the attack detection process into multiple independent modules: graph construction module, feature extraction module, detection module, and source tracing module. Each module handles a specific aspect of the problem, allowing the system to maintain high detection accuracy while providing interpretable source tracing information through the dedicated source tracing module
2Reliability
If graph neural network with millions of neurons is used, then detection capability is improved, but system complexity increases
Solution Approach 1:
The patent extracts only the essential features and relationships needed for attack detection from the complex graph neural network, rather than using the full model. By taking out and utilizing only the critical components for source tracing, the system maintains high detection capability while reducing complexity to manageable levels
Solution Approach 2:
The patent performs preliminary processing of network data into structured graph representations before feeding into the detection model. This preliminary action organizes the data in advance, reducing the computational complexity required during the actual detection phase while maintaining high reliability
Data Source
AI summary
An attack detection and source tracing method includes acquiring entities in a target network environment and interaction event information between the entities and constructing a network event graph with the entities and the interaction event information; determining a graph embedding vector of each interaction event information in the network event graph as feature information based on a preset attack feature recognition model and determining an attack event in the network event graph according to the feature information; determining dependencies between the attack event and remaining interaction event information in the network event graph and searching for a corresponding interaction event information as source tracing information of the attack event according to the dependencies.