An Anomaly Detection Method Based on Meta-Path and Heterogeneous Graph Attention Network

Advanced Persistent Threats (APT) in the current network environment are becoming increasingly complex and diverse. Most existing APT anomaly detection is based on attack knowledge bases and preset rules, which are difficult to design and cannot make good use of the rich semantic information in the original log data. This results in poor detection of unknown attacks. This paper proposes an anomaly detection method based on meta-path and heterogeneous provenance graph. We design a heterogeneous graph structure to represent provenance graph, and define the meta-paths of the PROCESS nodes. Then we use Heterogeneous Graph Attention Network (HAN) to learn the embedding representation of the nodes based on meta-paths. The resulting graph’s node embedding is used as node features, and then we apply SVDD algorithm to identify anomalous nodes. A series of experiments were conducted on the Unicorn SC-2 dataset to validate the proposed method. The final results demonstrate that our method outperforms two current anomaly detection systems.