| 刘丁玮* **,严瑾***,李振宇* **.基于混合图专家的入侵检测方法[J].高技术通讯(中文),2026,36(8):775~788 |
| 基于混合图专家的入侵检测方法 |
| Detecting intrusions with mixture-of-graph-experts model |
| |
| DOI：10. 3772 / j. issn. 1002 - 0470. 2026. 08. 001 |
| 中文关键词: 溯源图； 入侵检测； 图神经网络； 多任务训练； 混合专家模型 |
| 英文关键词: provenance graph, intrusion detection, graph neural network, multi-task learning, mixture-of-expert |
| 基金项目: |
| 作者 | 单位 | | 刘丁玮* ** | （*中国科学院计算技术研究所北京 100190）
（**中国科学院大学北京 100049）
（***中国互联网络信息中心北京 100070） | | 严瑾*** | | | 李振宇* ** | |
|
| 摘要点击次数: 21 |
| 全文下载次数: 17 |
| 中文摘要: |
| 网络攻击对企业和政府造成日益严重的威胁，入侵主机的行为尤为突出。溯源图因其能反映主机日志中的攻击上下文，被广泛应用于入侵检测。早期基于图粒度的方法仅能识别攻击的发生，而无法定位具体节点。近年来，越来越多的工作基于图学习实现了节点级的检测。然而，这些方法由于训练集的节点类别和特征分布不均衡，损害了模型的泛化能力，难以兼顾精确度和召回率。针对这一问题，本文提出了一种基于混合图专家的检测方法。其核心多门混合图专家模型（multi-gate mixture-of-graph-experts，MGE）融合了图神经网络（graph neural network, GNN）和多门混合专家（multi-gate mixture-of-experts，MMOE）。MGE设计了GNN图专家，用以捕捉反映攻击上下文的长流信息。特别地，共享的图专家由门控网络根据数据和下游任务自动调整组合，考虑了特征空间和任务间的差异性。为有效训练MGE，本文设计了3种监督信号：上游的输入重构用于提升特征表示的质量，下游的节点特征重构学习长流行为，和边的多标签分类学习短流行为。最后，利用下游的特征重构误差定位可疑进程并溯源报警。实验结果表明，MGE同时提升了节点级的精确度和召回率，在多个数据集上取得了优于基线方法的结果。 |
| 英文摘要: |
| Attacks pose an increasingly serious threat to enterprises and governments, and intrusions into hosts are particularly prominent. Provenance graphs are widely used in intrusion detection for their ability to reflect the attack context. Early graph-grained methods can only identify the occurrence of attacks but cannot locate specific nodes. Recently, more and more work has realized node-level detection based on graph learning. However, the uneven distribution of node categories and features in the training dataset undermines the generalization ability of the models, making it difficult to balance precision and recall. To solve this problem, this paper proposes a model called MGE that combines graph neural network (GNN) and multi-gate mixture-of-experts (MMOE). MGE assigns GNN expert combinations for different tasks via a gating network to capture long data flow information. In particular, the expert combination is automatically selected by the gating network according to node features, considering the differences in different parts of the feature space. To effectively train MGE, we design three types of supervise signals: upstream input reconstruction is used to improve the quality of feature representation, downstream node feature reconstruction learns long flow behavior, and edge multi-label classification learns short one-hop flow behavior. During testing, we use downstream feature reconstruction errors to locate suspicious processes and construct alarms. Experimental results show that the proposed method simultaneously improves accuracy and recall rate and achieves better results than baselines in multiple datasets. |
|
查看全文
查看/发表评论 下载PDF阅读器 |
| 关闭 |
|
|
|
