Abstract: Disclosed are an advanced persistent threat (APT) detection method and system based on a continuous-time dynamic heterogeneous graph network (CDHGN). The method includes: selecting network interaction event data, extracting entities from the network interaction event data as source nodes and target nodes, extracting an interaction event occurring between a source node and a target node as an edge, and determining a type and an attribute of a node, a type and an attribute of the edge, and a moment at which an interaction event occurs, to obtain a continuous-time dynamic heterogeneous graph; converting each type of edge in the continuous-time dynamic heterogeneous graph into a vector by a CDHGN encoder, to obtain an embedding representation by a CDHGN decoder to obtain a detection result of whether each type of edge is an abnormal edge, to intercept an APT attack.

Abstract: Disclosed are a method and system for detecting a complex multi-step attack in an electric power system. The method includes: collecting interaction behavior data of a network entity; preprocessing the interaction behavior data of the network entity based on a heterogeneous graph to obtain input data; and inputting the input data into a complex multi-step attack detection module to obtain an attack detection result. Information is extracted from the interaction behavior data to construct a node and an edge of the heterogeneous graph. Timestamp information of a destination node and an adjacent source node of the destination node is input into a Time2Vec layer to obtain a first time embedding representation. Data that fuses node feature information and the first time embedding representation is input into a Heteformer layer, and a second node embedding representation is obtained as input data and input into the complex multi-step attack detection module.