# APT Detection via Hypergraph Attention Network with Community-Based Behavioral Mining
## 6 Abnormal Behavioral Community Detection
### Seed Node Selection  
The LFM first selects seed nodes as the initial nodes for community detection. The seed nodes of the traditional LFM are randomly selected, which directly affects the quality of community detection. Therefore, we use node-level detection to discover potential abnormal nodes first in the provenance graph as seed nodes.  
Firstly, we extract the initial value of the feature for each node. The features of the node should reflect its behavior pattern in the provenance graph. Compared with benign nodes, abnormal nodes usually have different interaction patterns.  
The nodes in the provenance graph are classified into four types (process, file, registry, and socket). Interactions between different types of nodes can form 18 types of edges, as shown in Table 1.  
\begin{table}
\begin{tabular}{l l} \hline \hline
**Node Pair** & **Edge Type** \\ \hline process - process & create \\ process - file & create, read, write, close, delete \\ process - registry & open, query, enumerate, modify, close, delete \\ process - socket & send, receive, connect, accept, disconnect, reconnect \\ \hline \hline \end{tabular}
\end{table}
Table 1: Different Types of Edges in Provenance Graph.  
For each node \(v_{i}\) in the provenance graph, a vector in 36-dimensional \(e_{i}=[a_{1},a_{2},\ldots,a_{21},a_{22},a_{23},\ldots,a_{36}]\) is created as the initial feature of \(v_{i}\), where the first 18 dimensions are the features of incoming edges, and the last 18 dimensions are the features of outgoing edges.  
The first-order interaction pattern of nodes cannot capture the semantic causal relationship of the context, thus, it cannot be used for the judge of node states. Therefore, to learn the causal association of nodes, it is necessary to use a GNN to aggregate contextual information of each node to learn node features. Using the node type as a supervision signal, and classifying nodes into process, file, registry, or socket to train the GNN. The training formula is as follows:  
\[E^{(t)}=GNN(W^{(t-1)},G,E^{(t-1)})\]  
GNN can be trained through multiple layers. At layer \(t\), the node feature matrix \(E^{(t)}\) is updated, where \(G\) is the topological structure of the provenance graph (usually represented by an adjacency matrix), \(W^{(t-1)}\) is the trainable parameter matrix, and \(E^{(t-1)}\) is the calculation result of the formula for layer \(t-1\).  
On the provenance graph \(G\), stack \(t\) GNN layers to learn the final feature matrix \(E^{(T)}\), and then input it into a softmax classifier to classify node types according to the following formula:  
\[P=\text{softmax}(E^{(T)}\cdot W^{(T)})\]  
where \(P\) is the probability distribution of node type, \(W^{(T)}\) is the parameter matrix of the classifier, and \(E^{(T)}\) is the final feature matrix. The GNN is trained using gradient descent.  
Given the initial feature matrix \(E^{(0)}\) of the node in the provenance graph, input \(E^{(0)}\) into the trained encoder GNN. The encoder will output the final feature matrix \(E^{(T)}\) of the provenance graph.  
After obtaining the final feature matrix of each node in the provenance graph, seed node detection is considered as an outlier mining problem. Here, the outlier mining algorithm Isolation forest is used to detect outliers in all process nodes in the provenance graph [21], and these abnormal outlier nodes are selected as seed nodes. This algorithm has been proven to be an effective outlier mining algorithm for detecting outlier nodes in the provenance graph.