Network attack detection method based on knowledge graph and taint propagation

HUANG Mingyi; ZOU Futai; ZHOU Zhimo; ZHANG Liang

doi:10.11959/j.issn.2096-109x.2025011

您当前的位置：

首页 >

文章列表页 >

Network attack detection method based on knowledge graph and taint propagation

Papers | 更新时间：2025-03-20

- Network attack detection method based on knowledge graph and taint propagation
- Chinese Journal of Network and Information Security Vol. 11, Issue 1, Pages: 151-164(2025)
- 作者机构：
  
  1.上海交通大学网络空间安全学院，上海 200240
  2.国家电网有限公司华东分部，上海 200120
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(61831007);The National Key R&D Program of China(2020YFB1807500)
- DOI：10.11959/j.issn.2096-109x.2025011
  CLC： TP309
- Received：08 April 2024，
  
  Revised：2024-07-10，
  
  Published：25 February 2025
- 稿件说明：
移动端阅览
黄明义, 邹福泰, 周纸墨, 等. 基于知识图谱和污点传播的网络攻击检测方法[J]. 网络与信息安全学报, 2025, 11(1): 151-164.

HUANG M Y, ZOU F T, ZHOU Z M, et al. Network attack detection method based on knowledge graph and taint propagation[J]. Chinese Journal of Network and Information Security, 2025, 11(1): 151-164.
黄明义, 邹福泰, 周纸墨, 等. 基于知识图谱和污点传播的网络攻击检测方法[J]. 网络与信息安全学报, 2025, 11(1): 151-164. DOI： 10.11959/j.issn.2096-109x.2025011.

HUANG M Y, ZOU F T, ZHOU Z M, et al. Network attack detection method based on knowledge graph and taint propagation[J]. Chinese Journal of Network and Information Security, 2025, 11(1): 151-164. DOI： 10.11959/j.issn.2096-109x.2025011.

摘要

随着计算机和网络通信技术的迅猛发展，大数据背景下的网络攻击检测日益受到关注。尽管机器学习技术在此领域取得了良好效果，但数据集的标注和训练问题难以得到解决。传统的信念传播算法（belief propagation algorithm）虽然被广泛应用于图攻击检测，但其缺乏对节点和边类型的区分，且在处理恶意节点远少于良性节点场景时表现一般。为解决这些问题，提出了一种基于知识图谱和污点传播的网络攻击检测方法CDTP（community detection and taint propagation），通过定义IP地址、域名和文件3种实体，建立实体间的直接与间接关系来构建知识图谱，并在半监督环境下应用Louvain社区发现算法划分知识图谱，提取恶意实体相关的子图。另外，还提出了一种新型的污点传播算法，基于实体间的关系来推算节点的恶意值，从而能有效地发现恶意和受害实体，并可视化攻击路径。实验结果表明，无论是在仿真实验环境还是权威数据集上，CDTP都表现出了卓越的性能，远优于传统的信念传播算法。特别是在恶意节点数量较少的情况下，CDTP能够有效地检测攻击行为，且精度和召回率均远高于传统方法。这不仅证明了CDTP在网络攻击检测中的卓越性能，还表明它能够在复杂的网络环境中有效识别恶意行为，展现出其在实际应用中的优越性。

Abstract

With the rapid development of computer and network communication technologies

research on network attack detection in the context of big data has increasingly gained attention. Although machine learning techniques have achieved promising results in this field

issues related to dataset labeling and training have remained challenging. Traditional belief propagation algorithms

while widely used in graph-based attack detection

lacked the distinction between node and edge types and performed inadequately in scenarios where malicious nodes were far fewer than benign nodes. To address these issues

a network attack detection method based on knowledge graphs and taint propagation

referred to as CDTP (community detection and taint propagation)

was proposed. In this method

three types of entities (IP addresses

domain names

and files) were defined to establish both direct and indirect relationships between entities

and a knowledge graph was constructed. In a semi-supervised setting

the Louvain community detection algorithm was utilized to partition the knowledge graph and extract subgraphs related to malicious entities. Additionally

a novel taint propagation algorithm was introduced

which inferred the maliciousness score of nodes based on the relationships between entities

thereby effectively detecting malicious and victim entities and visualizing attack paths. Experimental results demonstrates that CDTP outperforms the traditional belief propagation algorithm in both simulated environments and authoritative datasets

showing superior performance. Particularly in scenarios where the number of malicious nodes is small

CDTP effectively detects attacks with significantly higher precision and recall compared to traditional methods. This proves that CDTP exhibits outstanding performance in network attack detection and effectively identifies malicious behaviors in complex network environments

demonstrating considerable superiority in practical applications.

关键词

Keywords

references

HNAMTE V , NAJAR A A , NHUNG-NGUYEN H , et al . DDoS attack detection and mitigation using deep neural network in SDN environment [J ] . Computers & Security , 2024 , 138 : 103661 .

LEE S Y , WI S , SEO E , et al . ProFiOt: abnormal behavior profiling (ABP) of IoT devices based on a machine learning approach [C ] // Proceedings of the 27th International Telecommunication Networks and Applications Conference (ITNAC) . Piscataway : IEEE Press , 2017 : 1 - 6 .

赵文博 , 马紫彤 , 杨哲 . 基于超图神经网络的恶意流量分类模型 [J ] . 网络与信息安全学报 , 2023 , 9 ( 5 ): 166 - 177 .

ZHAO W B , MA Z T , YANG Z . Model of the malicious traffic classification based on hypergraph neural network [J ] . Chinese Journal of Network and Information Security , 2023 , 9 ( 5 ): 166 - 177 .

CHAU D H P , NACHENBERG C , WILHELM J , et al . Polonium: Tera-scale graph mining and inference for malware detec-tion [C ] // Proceedings of 2011 Society for Industrial and Applied Mathematics International Conference on Data Mining . 2011 : 131 - 142 .

SUN X , DAI J , LIU P , et al . Using Bayesian networks for proba-bilistic identification of zero-day attack paths [J ] . IEEE Transac-tions on Information Forensics and Security , 2018 , 13 ( 10 ): 2506 - 2521 .

LYU M , DONG C , CHEN T , et al . A heterogeneous graph learning model for cyber-attack detection [J ] . arXiv preprint arXiv:2112. 08986 , 2021 .

SOSNOWSKI M , SATTLER P , ZIRNGIBL J , et al . Propagating threat scores with a TLS ecosystem graph model derived by active measurements [C ] // Proceedings of the 8th Network Traffic Measurement and Analysis Conference (TMA2024) . Piscataway : IEEE Press , 2024 : 1 - 11 .

LI A , WANG X , WANG W , et al . A survey of relation extraction of knowledge graphs [C ] // Proceedings of Asia-Pacific Web and Web-Age Information Management Joint International Conference on Web and Big Data . Berlin : Springer , 2019 : 52 - 66 .

ISMAIL M , ALRABAEE S , CHOO K K R , et al . A comprehensive evaluation of machine learning algorithms for Web application attack detection with knowledge graph integration [J ] . Mobile Networks and Applications , 2024 : 1 - 30 .

MILAJERDI S M , GJOMEMO R , ESHETE B , et al . HOLMES: real-time APT detection through correlation of suspicious infor-mation flows [C ] // Proceedings of 2019 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2019 : 1137 - 1152 .

NAJAFI P , MÜHLE A , PÜNTER W , et al . Malrank: a measure of maliciousness in SIEM-based knowledge graphs [C ] // Proceedings of the 35th Annual Computer Security Applications Conference . 2019 : 417 - 429 .

NAJAFI P , PUENTER W , CHENG F , et al . You are your friends: detecting malware via guilt-by-association and exempt-by-reputation [J ] . Computers & Security , 2024 , 136 : 103519 .

REN W , SONG X , HONG Y , et al . APT attack detection based on graph convolutional neural networks [J ] . International Journal of Computational Intelligence Systems , 2023 , 16 ( 1 ): 184 .

QI Y , GU Z , LI A , et al . Cybersecurity knowledge graph enabled attack chain detection for cyber-physical systems [J ] . Computers and Electrical Engineering , 2023 , 108 : 108660 .

PAXSON V . Bro: a system for detecting network intruders in real-time [J ] . Computer Networks , 1999 , 31 ( 23-24 ): 2435 - 246 .

PEIMANKAR A , PUTHUSSERYPADY S . DENS-ECG: a deep learning approach for ECG signal delineation [J ] . Expert Systems with Applications , 2021 , 165 : 113911 .

DIAKONIKOLAS I , GOEL S , KARMALKAR S , et al . Ap-proximation schemes for ReLU regression [J ] . arXiv preprint arXiv: 2005.12844 , 2020 .

BOURQUIN M , KING A , ROBBINS E . BinSlayer: accurate comparison of binary executables [C ] // Proceedings of the 2nd ACM SIGPLAN Program Protection and Reverse Engineering Workshop . New York : ACM Press , 2013 : 1 - 10 .

YING R , HE R , CHEN K , et al . Graph convolutional neural networks for web-scale recommender systems [C ] // Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining . New York : ACM Press , 2018 : 974 - 983 .

LOW T M , SPAMPINATO D G , MCMILLAN S , et al . Linear algebraic Louvain method in Python [C ] // Proceedings of 2020 IEEE International Parallel and Distributed Processing Symposium Workshops (IPDPSW) . Piscataway : IEEE Press , 2020 : 223 - 226 .

HE X , LU K , LI G . Taint reverse propagation for analysis of privacy leak [C ] // Proceedings of 2016 IEEE Trustcom/BigDataSE/I SPA . Piscataway : IEEE Press , 2016 : 1718 - 1722 .

PEARL J . Probabilistic reasoning in intelligent systems: networks of plausible inference [M ] . San Francisco : Morgan Kaufmann , 1988 .

FERRAG M A , MAGLARAS L , MOSCHOYIANNIS S , et al . Deep learning for cyber security intrusion detection: approaches, datasets, and comparative study [J ] . Journal of Information Secu-rity and Applications , 2020 , 50 : 102419 .

SHARAFALDIN I , LASHKARI A H , GHORBANI A A . Toward generating a new intrusion detection dataset and intrusion traffic characterization [C ] // Proceedings of the 4th International Con-ference on Information Systems Security and Privacy(ICISSP 2018). 2018 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Data recommendation algorithm of network security event based on knowledge graph

Research on construction technology of artificial intelligence security knowledge graph

Survey on explainable knowledge graph reasoning methods

Prediction method of 0day attack path based on cyber defense knowledge graph

Ontology summarization technology survey

Related Author

Zeyu GU

Zihao LIU

Wei LIU

Xianwei ZHU

Ling YU

Bo CHEN

Yinhui GE

Xiaochen SHEN

Related Institution

School of Computer and Electronic Information/School of Artificial Intelligence, Nanjing Normal University

School of Mathematical Science, Nanjing Normal University

⁰