# APT Detection via Hypergraph Attention Network with Community-Based Behavioral Mining
## 6 Abnormal Behavioral Community Detection
### Overlapping Behavioral Community Detection
\begin{table}
\begin{tabular}{l l} \hline \hline
**Dimensions** & **Features** \\ \hline \(d_{1}\) & \(\Delta(u.\text{timestamp},v.\text{timestamp})<t\) \\ \(d_{2}\) & \(u.\text{pid}=v.\text{pid}\) \\ \(d_{3}\) & \(u.\text{d.\_ip}=v.\text{d.\_ip}\) \\ \(d_{4}\) & \(u.\text{d.\_port}=v.\text{d.\_port}\) \\ \(d_{5}\) & \(u.\text{referer}=v.\text{referer}\) \\ \(d_{6}\) & \(u.\text{host}=v.\text{host}\) \\ \(d_{7}\) & \(u.\text{referer}=v.\text{host}\) \\ \(d_{8}\) & \(u.\text{host}=v.\text{referer}\) \\ \(d_{9}\) & \(u.\text{ppid}=v.\text{ppid}\) \\ \(d_{10}\) & \(u.\text{ppid}=v.\text{pid}\) \\ \(d_{11}\) & \(u.\text{pid}=v.\text{ppid}\) \\ \(d_{12}\) & \(u.\text{objname}=v.\text{objname}\) \\ \(d_{13}\) & \(u.\text{pname}=v.\text{pname}\) \\ \(d_{14}\) & \(u.\text{r.\_ip}=v.\text{d.\_ip}\) \\ \(d_{15}\) & \(u.\text{d.\_ip}=v.\text{r.\_ip}\) \\ \(d_{16}\) & \(u.\text{q.\_domain}=v.\text{h.\_domain}\) \\ \(d_{17}\) & \(u.\text{h.\_domain}=v.\text{q.\_domain}\) \\ \(d_{18}\) & \(u.\text{q.\_domain}=v.\text{referer}\) \\ \(d_{19}\) & \(u.\text{referer}=v.\text{q.\_domain}\) \\ \(d_{20}\) & \(u.\text{q.\_domain}=v.\text{res\_loc}\) \\ \(d_{21}\) & \(u.\text{res\_loc}=v.\text{q.\_domain}\) \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Rules of 21-Dimensional Feature Vector. Among them, \(f_{in}(C)\) represents the internal fitness of the original community \(C\), initially \(f_{in}(C)\) is 0; \(f_{in}(C,j)\) represents the internal fitness of community \(C\) after node \(j\) is added; \(F_{IN}(C,j)\) represents the fitness of node \(j\) in community \(C\), and the calculation formula is as follows: \begin{table}
\begin{tabular}{l l} \hline \hline
**Input:** & \\
1: Provenance graph \(PG=(V,E)\) & \\
2: Time threshold \(t\) & \\
**Output:** & \\
3: Set of overlapping communities \(C=\{C_{1},C_{2},\ldots,C_{m}\}\) & \\
4: **procedure**DetectCommunities(\(PG,t,\alpha\)) & \\
5: \(V_{send}\leftarrow\) AnomalyNodeDetection(\(PG\)) & \\
6: \(W\leftarrow\) CalculateNodeWeights(\(V\)) & \\
7: \(E_{weighted}\leftarrow\) CalculateEdgeWeights(\(E,t\)) & \\
8: \(HG\leftarrow\) ConstructWeightedHeterogeneousGraph(\(V,E_{weighted},W\)) & \\
9: \(C\leftarrow\emptyset\) & \\
10: **for**\(a\in V_{seed}\)do & \\
11: **if**\(a\) not assigned to any community **then** & \\
12: \(C_{\text{current}}\leftarrow\{a\}\) & \\
13: \(\text{fin}\gets 0\); \(\text{fout}\leftarrow\) & 0 \\
14: \(\text{Neighbors}\leftarrow\text{GetNeighborNodes}(a,HG)\) & \\
15: **while**\(\text{Neighbors}\
eq\emptyset\)do & \\
16: \(j\leftarrow\) SelectFirstNode(Neighbors) & \\
17: \(\text{FN}_{\text{th}}\leftarrow\sum_{i\in C_{\text{current}}}E_{\text{ weighted}}[i,j]\times W[j]\) & \\
18: \(\text{FOUT}\leftarrow\sum_{i\
eq G\cup C_{\text{current}}}E_{\text{ weighted}}[u,j]\times W[u]\) & \\
19: \(\text{fin}_{\text{new}}\leftarrow\text{fin}+F_{\text{IN}}\) & \\
20: \(\text{fout}_{\text{new}}\leftarrow\text{fout}+F_{\text{OUT}}\) & \\
21: \(\text{Fitness}_{\text{current}}\leftarrow\frac{\text{fin}_{\text{new}}}{( \text{fin}_{\text{new}}+\text{fout}_{\text{new}})^{2}}\) & \\
22: \(\text{Fitness}_{\text{new}}\leftarrow\frac{\text{fin}_{\text{new}}}{(\text{fin} _{\text{new}}+\text{fout}_{\text{new}})^{2}}\) & \\
23: **if**\(\text{Fitness}_{\text{new}}>\text{Fitness}_{\text{current}}\)**then** \\
24: \(\text{C}_{\text{current}}\leftarrow\text{C}_{\text{current}}\cup\{j\}\) & \\
25: \(\text{fin}\leftarrow\text{fin}_{\text{new}}\) & \\
26: \(\text{fout}\leftarrow\text{fout}_{\text{new}}\) & \\
27: \(\text{Neighbors}\leftarrow\text{UpdateNeighbors}(\text{Neighbors},j,HG)\) & \\
28: \(\text{else}\) & \\
29: \(\text{Neighbors}\leftarrow\text{Neighbors}\setminus\{j\}\) & \\
30: **endif** & \\
31: **end while** & \\
32: \(C\gets C\cup\{C_{\text{current}}\}\) & \\
33: **end if** & \\
34: **end for** & \\
35: **return**\(C\) & \\
36: **end procedure** & \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Definitions of Fitness Calculation Formulas. \[F_{IN}(C,j)= \begin{cases}\sum_{i\in C}E[i,j]*W(j),&\text{$i$ is a neighbor of $j$}\\ 0,&\text{else}\end{cases}