Provenance graph-oriented host intrusion detection method and system, and storage medium

A provenance graph-oriented host intrusion detection method, the method comprising:

• S1, acquiring provenance data of a host to be tested, and constructing a provenance graph representing user behaviors based on the provenance data;
• S2, mapping nodes in the provenance graph to roles, constructing a node feature matrix composed of feature vectors used to represent attribute features, structural features, and inter-node interactive relationship of the nodes in the provenance graph, and mapping nodes in the node feature matrix having similar feature vectors to the same role;
• S3, performing an attention-guided attribute temporal random walk on the provenance graph, and generating an attribute temporal random walk sequence the starting point of which is a current node vi, and the length of which is L:
• ϕ(Xi1), ϕ(Xi2), . . . , ϕ(XiL), where xi is the feature vector of the node vi;
• Φ(X) represents a function for mapping a node to a role, where (vit, vit+1)∈ET, 1 «t «L and T(vit, vit+1)«T(vit+1, vit+2), and (vit, vit+1) is an edge connected between a node vit and a next node vit+1;
• ET is a set composed of all edges in the provenance graph;
• t is a sequence number in the attribute temporal random walk sequence;
• and T(vit, vit+1)«T(vit+1, vit+2) indicates that a creation time of the edge between nodes vit and vit+1 is earlier than the creation time of the edge between nodes vit+1 and vit+2;
• and
• the current node walks to neighbor nodes corresponding to different roles at different probabilities, the probabilities being an attention parameter between the roles, and being used to reflect the importance between the roles;
• and
• S4, converting the attribute temporal random walk sequence into an embedding vector to extract a feature of the provenance graph, and performing intrusion anomaly detection by inputting the embedding vector to a pretrained intrusion detection model.