网络安全与数据治理2026，Vol.45Issue(4)：51-58,8.DOI:10.19358/j.issn.2097-1788.2026.04.007
一种融合多源异构数据的图神经网络联合框架
A joint framework of graph neural networks integrating multi-source heterogeneous data
摘要
Abstract
Aiming at the complex characteristics of cyberspace attack-defense confrontation,such as multi-step,concealed,and heterogene-ous,traditional methods relying on rule matching and statistical analysis can hardly meet the needs of accurate traceability and real-time situa-tion awareness.This paper proposes a joint framework of graph neural networks(GNNs)integrating multi-source heterogeneous data to realize automatic traceability of network attacks and dynamic situation awareness.Firstly,a heterogeneous information network(HIN)of network enti-ties-attack behaviors is constructed to integrate multi-source data such as traffic logs,vulnerability databases,and alarm information.Secondly,a spatiotemporal graph attention network(ST-GAT)based on the attention mechanism is designed to capture the temporal dependence of attack behaviors and the correlation characteristics of nodes.Finally,through attack path reasoning and risk level quantification,a closed loop from attack traceability to situation assessment is formed.Experiments are verified based on the CTU-13 and CSE-CIC-IDS2018 datasets.The results show that the framework is significantly superior to traditional methods,the mainstream temporal GNN variants and dedicated models in the field of network security in indicators such as attack traceability accuracy(92.7%)and situation assessment response time(≤0.3 s),provi-ding technical support for network security emergency response.关键词
图神经网络/网络攻击溯源/态势感知/异构信息网络/时空图卷积Key words
Graph Neural Network(GNN)/network attack traceability/situation awareness/Heterogeneous Information Network(HIN)/Spatiotemporal Graph Convolution(SGC)分类
信息技术与安全科学引用本文复制引用
胡开明,陈建华..一种融合多源异构数据的图神经网络联合框架[J].网络安全与数据治理,2026,45(4):51-58,8.基金项目
广东省普通高校特色创新项目(2023KTSCX269) （2023KTSCX269）
