Provenance Graph Host Intrusion Detection via Temporal Random Walks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional host intrusion detection methods using system calls or logs have low detection precision and require significant manpower and time for model training, as they perform shallow representation learning on provenance graph data, which is inadequate for complex and diverse user behaviors and attack methods.
Innovation Solution
A provenance graph-oriented host intrusion detection method that involves constructing a provenance graph, mapping nodes to roles, performing attention-guided attribute temporal random walks, and converting these sequences into embedding vectors for deep representation learning, using a SkipGram model and a pretrained intrusion detection model for anomaly detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If general graph embedding models (DeepWalk, Node2Vec, GraphSAGE) or graph kernel algorithms (Weisfeiler-Lehma) are used for representation learning on provenance graph data, then the method can be applied broadly, but the representation learning is shallow and detection precision is low
Solution Approach 1:
The patent changes the parameters of representation learning by introducing a customized random walk strategy that incorporates temporal information and role-based node classification. Instead of using fixed general-purpose embedding models, the system dynamically adjusts the random walk parameters (transition probabilities, walk length, number of walks) based on provenance graph characteristics, enabling deeper and more scenario-adaptive representation learning that captures both structural and temporal features for improved detection precision
Solution Approach 2:
The patent segments the provenance graph analysis into distinct phases: role assignment based on node features, temporal random walk generation, and embedding construction. By dividing the complex representation learning task into these manageable segments, the system can apply specialized techniques at each stage (role-based classification, temporal-aware random walks) rather than relying on a single general-purpose model, thereby achieving deeper representation while maintaining broad applicability
2Ease of manufacture
If conventional provenance-based detection methods are used, then the detection can be performed with existing models, but a lot of manpower and time are required to adjust and train the detection model
Solution Approach 1:
The patent performs preliminary action by pre-assigning roles to nodes based on their feature vectors before the actual detection process. This role assignment creates a structured foundation that guides subsequent random walks and embedding generation, eliminating the need for time-consuming iterative model adjustment during deployment. The preliminary structuring of data according to provenance roles enables faster, more efficient detection with reduced manual intervention
Solution Approach 2:
The system implements self-service through automated role assignment and embedding generation. The algorithm automatically classifies nodes into roles based on their features, generates appropriate random walks for each role, and constructs embeddings without requiring manual model configuration or training adjustment. This automation significantly reduces the manpower and time investment needed for model deployment while maintaining high detection precision
3Device complexity
If shallow representation learning is performed on provenance graph data, then the method is computationally simpler, but the acquired data features are limited and detection efficiency is low
Solution Approach 1:
The patent adds the temporal dimension to the representation learning process by incorporating time-stamped provenance events into the random walk strategy. Instead of treating the provenance graph as a static structure, the system utilizes temporal sequences of events to guide random walks, creating embeddings that capture both structural relationships and temporal patterns. This dimensional enhancement enriches the feature representation without requiring proportionally increased computational resources, thereby improving detection efficiency
Data Source
AI summary
The present invention discloses a provenance graph-oriented host intrusion detection method and system, and a storage medium, which relates to the field of cyber security. The method includes: S1, acquiring provenance data of a host to be tested, to construct a provenance graph representing user behaviors; S2, mapping nodes in the provenance graph to roles, constructing a node feature matrix composed of feature vectors which can be used to represent attribute features, structural features, and inter-node interactive relationship of the nodes in the provenance graph, and mapping nodes having similar feature vectors to the same role; S3, performing an attention-guided attribute temporal random walk by comprehensively considering attributes of the nodes in the provenance graph, the temporal relationship between edges, and an attention parameter between different roles; and S4, converting the acquired attribute temporal random walk sequence into an embedding vector to extract a feature of the provenance graph, and performing intrusion anomaly detection. The present invention can perform deep representation learning on provenance data, reduce the workload of training a detection model, and improve the accuracy and efficiency of intrusion detection.