DASM: Dual Attention Subgraph Matching Model Incorporating Local Behavior-Aware Features for Threat Hunting

Threat hunting represents a crucial instrument for safeguarding network security, entailing the proactive identification of potential security threats within a system. However, the types of operations represented in the provenance graphs are diverse and complex. Most learning-based threat matching methods concentrate on the learning of the overall graph structure, yet they neglect to delve deeply into the local structural features that emerge under different operation types. To address these issues, this paper proposes DASM, a dual attention subgraph matching model incorporating local behavior-aware features for threat hunting. Specifically, at the local level, we propose a local operational feature learning method for the provenance graph, constructing an independent local graph for each operation type and applying a node attention mechanism to refine feature learning. At the global level, we design an attack operational semantic attention network that adaptively adjusts the importance weights of different operations, ensuring that core behavioral features are accurately identified. DASM effectively captures local details while emphasizing global behavioral patterns, thereby enhancing the accuracy and reliability of complex attack pattern matching. Subsequently, we implement an efficient graph matching procedure for provenance and attack query vectors in an ordered embedding space. Experimental results show that DASM excels in attack graph matching on the DARPA dataset, achieving 95% accuracy and outperforming recent provenance graph-based attack subgraph matching methods.