Attack detection method and device, electronic equipment and storage medium

Abstract

The invention provides an attack detection method and apparatus, electronic equipment and a storage medium. The method comprises the steps of obtaining target instruction tracking information when a target program runs; determining a target entity relation graph between target instruction execution entities based on the target instruction tracking information; and based on a graph neural network model and the target entity relationship graph, detecting that the target program is an attack program. The defect of poor quality of attack detection training samples in the prior art is overcome by acquiring the target instruction tracking information when the target program runs, the entity relationship graph between the target instruction execution entities is determined on the basis of the target instruction tracking information, and then the target program is detected through the graph neural network model. The method can be used for automatic feature representation learning and topological mode learning, the defects that an existing attack detection method excessively depends on manual feature extraction and cannot capture a graph topological relation mode of a non-Euclidean space are overcome, and attacks are accurately and reliably detected.

Description

technical field [0001] The present invention relates to the field of computer technology, in particular to an attack detection method, device, electronic equipment and storage medium. Background technique [0002] Modern computer systems are being attacked by various attack programs and are at great risk, so it is particularly important to be able to detect attacks as accurately as possible. [0003] The current attack detection methods are only designed to capture the relational patterns of Euclidean space, and cannot adapt to the complex semantic patterns of computer programs. This method first converts the behavior of a series of events into sequences in Euclidean space, which constitute the temporal relationship between events, and then uses sequence analysis techniques to learn sequence patterns from historical events and predict the next event, if the actual If there is a large deviation between the occurred event and the predicted event, it is considered as a suspici...

AI Technical Summary

Problems solved by technology

[0004] The invention provides an attack detection method, device, electronic equipment and storage medium, which are used to solve the defect of inaccurate and reliable attack recognition results in the prior art, and realize accurate and reliable detection of attacks.

Images