Apt detection method and system based on continuous-time dynamic heterogeneous graph network

An APT detection system based on a CDHGN, comprising a graph constructing module, a network encoder, and a network decoder, wherein

• the graph constructing module is configured to:
• select network interaction event data in a specified time period, extract entities from the network interaction event data as source nodes and target nodes, extract an interaction event occurring between a source node and a target node as an edge, and determine a type and an attribute of a node, a type and an attribute of the edge, and a moment at which an interaction event occurs, to obtain a continuous-time dynamic heterogeneous graph;
• the network encoder is configured to convert each type of edge in the continuous-time dynamic heterogeneous graph into a vector, to obtain an embedding representation of each type of edge;
• and
• the network decoder is configured to decode the embedding representation of each type of edge in the continuous-time dynamic heterogeneous graph to obtain a detection result of whether each type of edge is an abnormal edge, so as to intercept an APT attack according to the abnormal edge.