Complex network attack detection method based on cross-host abnormal behavior recognition

A complex network attack detection method based on cross-host abnormal behavior recognition, comprising the following steps:

• 1) Intra-host abnormal behavior detection:
• firstly collecting kernel log data of a host to construct an intra-host association graph, then employing a graph convolution network (GCN) to extract features, and finally using an autoencoder to detect abnormal nodes in the intra-host association graph, wherein the step 1) further comprises:
• 1-1) constructing a benign intra-host association graph:
• collecting system log data generated during normal operation of the host, and constructing an association graph nIAGk, where nodes of the association graph nIAGk represent system entities, and edges thereof represent interaction events that occur between the system entities;
• 1-2) extracting initial features of the nodes:
• an initial feature vector xi of each node vi in nIAGk is [ai1, ai2, . . . , aiN], where aij is the number of edges of a jth type among a set of edges formed by connecting the node vi to its one-hop neighbor nodes in the association graph nIAGk;
• 1-3) extracting semantic features of the nodes:
• using a graph convolutional neural network to process the association graph nIAGk, and updating the feature vector of each node vi in the association graph nIAGk, to obtain a semantic feature vector of each node;
• 1-4) autoencoder training:
• collecting semantic feature vectors of all “process” nodes in the association graph nIAGk of all hosts, and inputting the semantic feature vectors into an autoencoder for training, to output a reconstruction vector;
• 1-5) intra-host anomaly detection:
• collecting real-time system log data to construct an association graph rIAGk;
• extracting a semantic feature vector yi of each process node in the association graph rIAGk, and inputting the vector yi into the autoencoder trained in the step 1-4) to obtain the outputted reconstruction vector zi;
• when a difference between the semantic feature vector vi and the reconstruction vector y is greater than a specified threshold, the process node is deemed to be an abnormal node;
• and
• 1-6) intra-host anomaly scoring:
• calculating an anomaly score of each abnormal node vi according to the formula (1), and then calculating the anomaly score of the host Hk according to formula (2), where B(Hk) represents a set of abnormal nodes of the host Hk
• s
• ⁡
• (
• v
• i
• )
• =
• 
• y
• i
• -
• z
• i
• 
• F
• 2
• (
• 1
• )
• s
• ⁡
• (
• H
• k
• )
• =
• max
• v
• i
• ∈
• B
• ⁡
• (
• H
• k
• )
• s
• ⁡
• (
• v
• i
• )
• ;
• (
• 2
• )
• 2) Inter-host abnormal behavior detection:
• firstly constructing an inter-host interaction graph by using network flow log data, then training a prediction model based on a sequence of the inter-host interaction graph, and finally detecting abnormal edges in the inter-host interaction graph according to prediction differences, wherein the step 2) further comprises:
• 2-1) constructing a sequence of inter-host interaction graphs:
• collecting log data of inter-host network interactions to construct an inter-host interaction graph IRGt;
• a node of an inter-host interaction graph IRGt at each discrete time slot t is a host, and an edge represents an interaction between different hosts at the time slots t-1 and t;
• a sequence of inter-host interaction graphs at continuous time slots can be defined as IRGS=<IRG1, IRG2, . . . , IRGT>;
• 2-2) constructing a training set:
• using a sliding window with a window size of w and a step size of 1 to segment a sequence of an inter-host interaction graph to form a training set SS;
• each training sample St in the SS is defined as (Dt, Lt), where Dt, is a data part of St, and Lt is a label part of St:
• 2-3) training an inter-host interaction graph prediction model:
• training a prediction model based on the training set SS, and predicting the next inter-host interaction graph according to w continuous inter-host interaction graphs;
• and
• 2-4) inter-host anomaly detection:
• following the step 2-1) to generate w inter-host interaction graphs Dt=<IRGt-w, IRGt-w+1, IRGt-1> before the current time slot t:
• inputting Dt into the prediction model trained in the step 2-3) to predict and obtain an adjacent matrix pIRAt at the time slot t;
• comparing the adjacent matrix pIRAt with a real adjacent matrix IRAt at the time slot t, and determining whether the interaction between the hosts Hi and Hj at the time slot t is abnormal;
• and
• 3) Cross-host network attack detection:
• firstly constructing a cross-host anomaly association graph according to intra-host and inter-host anomaly detection results, then propagating anomaly scores by employing a PageRank algorithm, and finally confirming an attacked host based on the anomaly scores;
• wherein detailed steps of cross-host complex network attack detection in step 3) are as follows:
• 3-1) constructing a cross-host anomaly association graph:
• constructing a cross-host anomaly association graph CG as follows according to a given time slot t, an intra-host data collection time span w, and a set HS of hosts in the target network, wherein a cross-host anomaly association graph is constructed as follows according to the step 3-1):
• 3-1-1) collecting system log data of each host generated between time slots t-w and t, to construct the association graph rIAGk:
• 3-1-2) based on the association graph rIAGk in the step 3-1-1), detecting abnormal nodes in the association graph rIAGk according to step 1-5), performing anomaly scoring for each host according to step 1-6), and recording the anomaly score as sk:
• 3-1-3) collecting the inter-host interaction graphs generated between the time slots t-w and t, and forming a sequence Dt=<IRGt-w, IRGt-w+1, . . . , IRGt-1> of the inter-host interaction graphs:
• 3-1-4) following step 2-4) to detect any inter-host abnormal interaction at the time slot t;
• and
• 3-1-5) constructing a cross-host anomaly association graph CG;
• 3-2) propagating the anomaly scores:
• using the PageRank algorithm to iteratively update a weight of each node in the cross-host anomaly association graph CG;
• wherein detailed steps of the step 3-2) are as follows:
• 3-2-1) setting an initial weight PR(Pk) of each node pk in the cross-host anomaly association graph CG as an anomaly score sk of the host Hk:
• 3-2-2) updating the weight of each node pk in the cross-host anomaly association graph CG according to the formula (3);
• in the formula (3), d is a damping coefficient, NCG is the number of nodes in CG, I(pk) is a set of nodes corresponding to all incoming edges of the node pk, and L(pi) is an outgoing degree of the node pi;
• and
• PR
• ⁡
• (
• p
• k
• )
• =
• 1
• -
• d
• N
• C
• ⁢
• G
• +
• d
• (
• ∑
• p
• i
• ∈
• I
• ⁡
• (
• p
• k
• )
• PR
• ⁡
• (
• p
• i
• )
• L
• ⁡
• (
• p
• i
• )
• )
• (
• 3
• )
• 3-2-3) when weight variation of any node after this iteration is less than a specified threshold, or the number of iterations reaches a specified upper limit, stopping the iteration, otherwise jumping to the step 3-2-2) to restart the iteration;
• and
• 3-3) detecting an attacked host:
• confirming a host represented by a node in the cross-host anomaly association graph CG whose weight is higher than the specified threshold as the attacked host, and confirming a pair of attacked hosts connected by an edge as lateral movement targets of an attacker.