一种融合多源异构数据的图神经网络联合框架OA

Aiming at the complex characteristics of cyberspace attack-defense confrontation,such as multi-step,concealed,and heterogene-ous,traditional methods relying on rule matching and statistical analysis can hardly meet the needs of accurate traceability and real-time situa-tion awareness.This paper proposes a joint framework of graph neural networks(GNNs)integrating multi-source heterogeneous data to realize automatic traceability of network attacks and dynamic situation awareness.Firstly,a heterogeneous information network(HIN)of network enti-ties-attack behaviors is constructed to integrate multi-source data such as traffic logs,vulnerability databases,and alarm information.Secondly,a spatiotemporal graph attention network(ST-GAT)based on the attention mechanism is designed to capture the temporal dependence of attack behaviors and the correlation characteristics of nodes.Finally,through attack path reasoning and risk level quantification,a closed loop from attack traceability to situation assessment is formed.Experiments are verified based on the CTU-13 and CSE-CIC-IDS2018 datasets.The results show that the framework is significantly superior to traditional methods,the mainstream temporal GNN variants and dedicated models in the field of network security in indicators such as attack traceability accuracy(92.7%)and situation assessment response time(≤0.3 s),provi-ding technical support for network security emergency response.