# APT Detection via Hypergraph Attention Network with Community-Based Behavioral Mining
## 6 Abnormal Behavioral Community Detection
### Overlapping Behavioral Community Detection  
Based on the abnormal seed nodes, we will then divide the overlapping behavior communities. As mentioned earlier, there are no clear boundaries for behaviors in the provenance graph. So, we set a series of weight rules, calculate the weight for each edge and each node in the provenance graph, and reconstruct the provenance graph into a weighted heterogeneous graph, and then divide behaviors through fitness calculation. Assign a 21-dimensional feature vector, as shown in Table 2, and calculate the weights for each node in the provenance graph. The weight corresponding to a node is the sum of the values of all bits of the initial feature vector corresponding to the node. For two vertices \(u\) and \(v\) connected by an edge, the explanations for different characteristics are as follows:  
* \(d_{1}=1\): if and only if the time difference between \(u\) and \(v\) is less than the threshold \(t\), where the threshold \(t\) can be customized by the user. * \(d_{2}=1\): if and only if \(u\) and \(v\) have the same process id. * \(d_{3}=1\): if and only if the destination IP of \(u\) and \(v\) are the same. * \(d_{4}=1\): if and only if the ports of \(u\) and \(v\) are the same. * \(d_{5}\) to \(d_{8}=1\): if and only if the corresponding characteristics of \(u\) and \(v\) in the socket logs are the same. \(d_{9}\) to \(d_{11}=1\): if and only if \(u\) and \(v\) are sibling processes or parent-child processes. * \(d_{12}=1\): if and only if \(u\) and \(v\) access the same object. * \(d_{13}=1\): if and only if \(u\) and \(v\) have the same process name. * \(d_{14}\) and \(d_{15}=1\): if and only if the outbound/inbound network requests are related to DNS queries. * \(d_{16}\) to \(d_{21}=1\): if and only if DNS query behaviors are related to web browsing behaviors. Calculate the weight of each edge according to the above rules to obtain a set of edge weights. After obtaining the set of node weights and the set of edge weights, reconstruct the provenance graph, add weighted attributes to each node and each edge, and form the corresponding heterogeneous graph. Based on the obtained weighted heterogeneous graph, the improved LFM algorithm is then used for overlapping community detection. Since the initial nodes of the algorithm have been obtained through anomaly node detection, the main idea of LFM is: based on the initial abnormal nodes, detect the natural community of node \(a\), and remove \(a\) from the seed node set. Repeat the operation until all nodes are assigned to at least one group or the seed node set is empty, and then the detection algorithm is completed. The details are shown in Algorithm 1. In this algorithm, the relationship between nodes and natural communities is expressed by fitness. The algorithm process will be described in detail below. The meaning of the formulas used in the process is shown in Table 3.  
If a node \(a\) is selected as a community \(C\), at this time, both the internal fitness \(f_{in}(C)\) and the external fitness \(f_{out}(C)\) of community \(C\) are 0. Firstly, select any neighbor node \(j\) (not including the nodes in community \(C\)) from the set of neighbor nodes of community \(C\) and add it to community \(C\), and calculate the internal fitness \(f_{in}(C,j)\) and external fitness \(f_{out}(C,j)\) of community \(C\) at this time. The formula for internal fitness is as follows:  
\[f_{in}(C,j)=f_{in}(C)+F_{IN}(C,j)\]