A Method for Detecting Post-Exploitation Malicious Communication Traffic Based on Hypergraph Neural Networks

Malicious communication is the most common type of post-exploitation malicious attack behavior. In the long-term and persistent process of post-exploitation malicious communication, attackers continuously encrypt and transmit various types of information stolen from the target network through the established C&C channel. However, existing methods are easily deceived by the variable infrastructure or disguised certificates used by attackers, or cannot fully capture the multifaceted information and their interrelationships in encrypted traffic. To overcome these limitations, in this paper, we propose a multi class detection method for post-exploitation malicious communication traffic based on hypergraph neural networks. This method calculates the cosine similarity between traffic state nodes through session flow statistical features as edges and edge weights to strengthen the correlation structure between session flow nodes. Based on the network communication behavior graph, a hypergraph structure of host layer traffic interaction is constructed. Finally, a multi classification detection model for post-exploitation malicious communication traffic based on hypergraph neural networks is proposed, which uses hyperedge convolution to layer process vertex and hyperedge features, and uses hyperedge pooling to sort and retain effective information by weight, thus better learning hypergraph structural data. The experimental results show that this method can more accurately model the multivariate relationships between communication traffic and effectively achieve multi classification detection of post-exploitation malicious communication traffic.