Flurry：一个可复制多层起源图表示学习的快速框架
Flurry: a Fast Framework for Reproducible Multi-layered Provenance Graph Representation Learning
摘要：
像知识图谱这样的复杂异构动态网络是可以用于对来自计算机系统的数据起源进行建模的强大构造。从安全的角度来看，这些属性图可以进行因果关系分析和跟踪，以分析无数的网络攻击。然而，在将系统执行和起源转换为用于机器学习任务的可用图形表示的管道的系统开发中存在不足。这种仪器的缺乏严重阻碍了起源图机器学习的科学进步，阻碍了可重复性，并限制了数据的可用性，这些数据对图神经网络等技术至关重要。为了满足这一需求，我们提出了Flurry，这是一个端到端的数据管道，它模拟网络攻击，在多个系统和应用程序层捕获这些攻击的来源数据，将这些攻击的审计日志转换为数据来源图，并将这些数据与用于训练深度神经模型的框架相结合，该框架支持预配置或定制设计的模型，用于在现实世界的弹性系统中进行分析。我们通过处理来自多个系统攻击的数据并使用当前的基准图表示学习框架通过图分类执行异常检测来展示此管道。Flurry提供了一个快速、可定制、可扩展和透明的解决方案，为网络安全专业人员提供这些急需的数据。
英文摘要：
Complex heterogeneous dynamic networks like knowledge graphs are powerful constructs that can be used in modeling data provenance from computer systems. From a security perspective, these attributed graphs enable causality analysis and tracing for analyzing a myriad of cyberattacks. However, there is a paucity in systematic development of pipelines that transform system executions and provenance into usable graph representations for machine learning tasks. This lack of instrumentation severely inhibits scientific advancement in provenance graph machine learning by hindering reproducibility and limiting the availability of data that are critical for techniques like graph neural networks. To fulfill this need, we present Flurry, an end-to-end data pipeline which simulates cyberattacks, captures provenance data from these attacks at multiple system and application layers, converts audit logs from these attacks into data provenance graphs, and incorporates this data with a framework for training deep neural models that supports preconfigured or custom-designed models for analysis in real-world resilient systems. We showcase this pipeline by processing data from multiple system attacks and performing anomaly detection via graph classification using current benchmark graph representational learning frameworks. Flurry provides a fast, customizable, extensible, and transparent solution for providing this much needed data to cybersecurity professionals.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
