HASGDetector: An Effective Host-Based Intrusion Anomaly Detection Framework With Large-Scale Attribute Heterogeneous Graphs
Guohua Xie, Xiaolong Xu, Honghao Gao, Muddesar Iqbal · IEEE Transactions on Consumer Electronics · 2025
With the widespread adoption of consumer electronic devices, host-based attack methods have become increasingly diverse, including malware implantation, advanced persistent threats (APTs), along with zero-day and stealth attacks, pose significant challenges to existing security defenses. Current detection methods often struggle with issues such as difficulties in data storage and retrieval, high computational resource consumption, and elevated false positive rates, especially when dealing with large-scale datasets and long-term complex attacks. To address these challenges, in this paper, we proposed HASGDetector, an anomaly detection scheme based on large-scale attribute heterogeneous graphs. Without relying on any prior knowledge or labeled data, HASGDetector effectively learns patterns of normal behavior and identifies unknown anomalous activities. HASGDetector processes the source graph in segments, dividing large-scale data into smaller subgraphs, which reduces computational overhead and improves real-time performance. By dynamically updating the features of nodes and edges, it captures contextual and temporal dependencies to construct feature snapshots. Leveraging multi-hop neighbor sampling and attention mechanisms for directed heterogeneous graphs, HASGDetector effectively detects anomalous nodes while reducing noise interference. Additionally, the progressive network framework is designed to enhance the model’s adaptability to new attack patterns by reusing knowledge. Experimental evaluations demonstrate that HASGDetector outperforms state-of-the-art detection methods such as PROGRAPHER and THREATRACE with multiple datasets, including StreamSpot, UNCORIN-SC, and DARPA TC E3. The recall rate on various datasets reaches up to 0.999, significantly reducing both false negative and false positive rates.