中图分类号： TP309
文献标识码： A
DOI： 10.19358/j.issn.2096-5133.2021.12.001
引用格式： 胡启宬，何树果，朱震. 基于图神经网络进程行为嵌入表示的入侵检测[J].信息技术与网络安全，2021，40(12)：1-7.

Intrusion detection with Graph Neural Network-based process behavior embedding

Abstract： Intrusion detection is important in ensuring the security of cyberspace. With the evolution of intrusion techniques, intrusion detection system of new generation is in need of an integration of artificial intelligence technology. In this paper, a method of intrusion detection with Graph Neural Network-based process behavior embedding is introduced. This method converts event log of computer systems into the system log object connection graph, and uses framework of Graph Neural Network to embed the vertices of the graph, so as to obtain the vector representation of the process behavior; on this basis, it establishes a multi-stage transition model that describes the overall process behavior baseline for the system, and uses the degree of deviation from this baseline as the basis for intrusion behavior detection. With verification of multiple attack scenarios, the method can detect intrusions effectively.

Key words : intrusion detection；Graph Neural Network；graph representation learning；anomaly detection