Attack Path Prediction System Based On Hypergraph Residual Auto-Encoder

In recent years,the world has witnessed a surge in network security incidents that have caused significant harm to countries,societies,and individuals.Predicting attack paths can guide security personnel to actively defend against threats and improve the overall security of networks.While current research mainly employs attack graph to predict and display the relationships between different attacks,methods based on security measurement,such as the shortest attack path or the maximum number of attack paths,are insufficient for targeted defense.Bayesian attack graph and Markov chains can provide clear descriptions of attack routes,but their algorithms are time-consuming and they only focus on low-order pairwise correlations between nodes,failing to reveal highorder relationships among nodes.To address the aforementioned issues,this paper proposes an attack path prediction algorithm based on hypergraph residual autoencoder link prediction and develops a visualized system for the algorithm.The completed work is as follows:For the mission of intrusion detection,considering that most network data in reality only have features but no explicit label types with high-order temporal correlations,a combination of hypergraph neural network and recurrent neural network is used to train an intrusion detection model,with the experimental datasets including intrusion detection datasets CIC-IDS2017,NSL-KDD,UNSW-NB15,and compared with commonly used intrusion detection algorithms.The hypergraph is constructed based on the similarity between nodes for intrusion detection.For the mission of link prediction,the standard graph convolution network in the variational graph autoencoder is optimized to a hypergraph neural network,which combines the hypergraph attention mechanism,the residual structure,and the multi-scale idea.As there are no authorized graph structure anomaly datasets,hypergraphs are first constructed by different methods for Cora,Citeseer,Pubmed,and CIC-IDS2017 intrusion detection datasets.Ablation experiments were conducted to evaluate various improvements,and the results showed that the hypergraph residual autoencoder outperforms other graph-based link prediction algorithms on homogeneous graphs.The algorithm’s performance was further verified through comparisons with other graphbased link prediction methods.The study confirmed that the hypergraph residual autoencoder has advantages in predicting links in homogeneous graphs,and the model’s robustness to missing features and edges was tested using anomaly datasets.Additionally,parameter sensitivity analysis was conducted to determine the optimal number of nodes in hyperedges.Finally,the application scenarios of hypergraph autoencoders in heterogeneous graphs were expanded.Lastly,the hypergraph residual autoencoder is integrated with the hypergraph neural network and the recurrent neural network to design and implement a network attack path prediction system for practical applications.