Complex network attack detection method based on cross-host abnormal behavior recognition

1. A complex network attack detection method based on cross-host abnormal behavior recognition, comprising the following steps:

1) Intra-host abnormal behavior detection: firstly collecting kernel log data of a host to construct an intra-host association graph, then employing a graph convolution network (GCN) to extract features, and finally using an autoencoder to detect abnormal nodes in the intra-host association graph, wherein the step 1) further comprises:

1-1) constructing a benign intra-host association graph: collecting system log data generated during normal operation of the host, and constructing an association graph nIAG k , where nodes of the association graph nIAG k represent system entities, and edges thereof represent interaction events that occur between the system entities;

1-2) extracting initial features of the nodes: an initial feature vector x i of each node v i in nIAG k is [a i1 , a i2 , . . . , a iN ], where a ij is the number of edges of a j th type among a set of edges formed by connecting the node v i to its one-hop neighbor nodes in the association graph nIAG k ;

1-3) extracting semantic features of the nodes: using a graph convolutional neural network to process the association graph nIAG k , and updating the feature vector of each node v i in the association graph nIAG k , to obtain a semantic feature vector of each node;

1-4) autoencoder training: collecting semantic feature vectors of all “process” nodes in the association graph nIAG k of all hosts, and inputting the semantic feature vectors into an autoencoder for training, to output a reconstruction vector;

1-5) intra-host anomaly detection: collecting real-time system log data to construct an association graph rIAG k ; extracting a semantic feature vector y i of each process node in the association graph rIAG k , and inputting the vector y i into the autoencoder trained in the step 1-4) to obtain the outputted reconstruction vector z i ; when a difference between the semantic feature vector v i and the reconstruction vector y is greater than a specified threshold, the process node is deemed to be an abnormal node; and

1-6) intra-host anomaly scoring: calculating an anomaly score of each abnormal node v i according to the formula (1), and then calculating the anomaly score of the host H k according to formula (2), where B(H k ) represents a set of abnormal nodes of the host H k

s

⁡

(

v

i

)

=



y

i

-

z

i



F

2

(

1

)

s

⁡

(

H

k

)

=

max

v

i

∈

B

⁡

(

H

k

)

s

⁡

(

v

i

)

;

(

2

)

2) Inter-host abnormal behavior detection: firstly constructing an inter-host interaction graph by using network flow log data, then training a prediction model based on a sequence of the inter-host interaction graph, and finally detecting abnormal edges in the inter-host interaction graph according to prediction differences, wherein the step 2) further comprises:

2-1) constructing a sequence of inter-host interaction graphs: collecting log data of inter-host network interactions to construct an inter-host interaction graph IRG t ; a node of an inter-host interaction graph IRG t at each discrete time slot t is a host, and an edge represents an interaction between different hosts at the time slots t-1 and t; a sequence of inter-host interaction graphs at continuous time slots can be defined as IRGS=<IRG 1 , IRG 2 , . . . , IRG T >;

2-2) constructing a training set: using a sliding window with a window size of w and a step size of 1 to segment a sequence of an inter-host interaction graph to form a training set SS; each training sample S t in the SS is defined as (D t , L t ), where D t , is a data part of S t , and L t is a label part of S t :

2-3) training an inter-host interaction graph prediction model: training a prediction model based on the training set SS, and predicting the next inter-host interaction graph according to w continuous inter-host interaction graphs; and

2-4) inter-host anomaly detection: following the step 2-1) to generate w inter-host interaction graphs D t =<IRG t-w , IRG t-w+1 , IRG t-1 > before the current time slot t: inputting D t into the prediction model trained in the step 2-3) to predict and obtain an adjacent matrix pIRA t at the time slot t; comparing the adjacent matrix pIRA t with a real adjacent matrix IRA t at the time slot t, and determining whether the interaction between the hosts H i and H j at the time slot t is abnormal; and

3) Cross-host network attack detection: firstly constructing a cross-host anomaly association graph according to intra-host and inter-host anomaly detection results, then propagating anomaly scores by employing a PageRank algorithm, and finally confirming an attacked host based on the anomaly scores; wherein detailed steps of cross-host complex network attack detection in step 3) are as follows:

3-1) constructing a cross-host anomaly association graph: constructing a cross-host anomaly association graph CG as follows according to a given time slot t, an intra-host data collection time span w, and a set HS of hosts in the target network, wherein a cross-host anomaly association graph is constructed as follows according to the step 3-1):

3-1-1) collecting system log data of each host generated between time slots t-w and t, to construct the association graph rIAG k :

3-1-2) based on the association graph rIAG k in the step 3-1-1), detecting abnormal nodes in the association graph rIAG k according to step 1-5), performing anomaly scoring for each host according to step 1-6), and recording the anomaly score as s k :

3-1-3) collecting the inter-host interaction graphs generated between the time slots t-w and t, and forming a sequence D t =<IRG t-w , IRG t-w+1 , . . . , IRG t-1 > of the inter-host interaction graphs:

3-1-4) following step 2-4) to detect any inter-host abnormal interaction at the time slot t; and

3-1-5) constructing a cross-host anomaly association graph CG;

3-2) propagating the anomaly scores: using the PageRank algorithm to iteratively update a weight of each node in the cross-host anomaly association graph CG; wherein detailed steps of the step 3-2) are as follows:

3-2-1) setting an initial weight PR(P k ) of each node p k in the cross-host anomaly association graph CG as an anomaly score s k of the host H k :

3-2-2) updating the weight of each node p k in the cross-host anomaly association graph CG according to the formula (3); in the formula (3), d is a damping coefficient, N CG is the number of nodes in CG, I(p k ) is a set of nodes corresponding to all incoming edges of the node p k , and L(p i ) is an outgoing degree of the node p i ; and

PR

⁡

(

p

k

)

=

1

-

d

N

C

⁢

G

+

d

(

∑

p

i

∈

I

⁡

(

p

k

)

PR

⁡

(

p

i

)

L

⁡

(

p

i

)

)

(

3

)

3-2-3) when weight variation of any node after this iteration is less than a specified threshold, or the number of iterations reaches a specified upper limit, stopping the iteration, otherwise jumping to the step 3-2-2) to restart the iteration; and

3-3) detecting an attacked host: confirming a host represented by a node in the cross-host anomaly association graph CG whose weight is higher than the specified threshold as the attacked host, and confirming a pair of attacked hosts connected by an edge as lateral movement targets of an attacker.

2. The complex network attack detection method based on cross-host abnormal behavior recognition according to claim 1 , wherein a structure of the prediction model in the step 2-3) comprises the following four layers:

an input layer: an adjacent matrix IRA k of an edge set of an inter-host interaction graph is inputted;

a convolutional layer: each IRA k is inputted into a convolutional neural network to generate a feature matrix CM k ;

a circulation layer: t continuous feature matrices CM k are inputted into an LSTM to generate a feature matrix RM; and

an output layer: RM is inputted into a fully connected neural network to generate an adjacent matrix pIRA t at a predicted time slot t.