Abstract
Cyber-attacks continue to grow in scale and sophistication, yet existing network intrusion detection approaches lack the semantic depth required for path reasoning over attacker-victim interactions. We address this by first modelling network alerts as a knowledge graph, then formulating hyper-relational alert prediction as a hyper-relational knowledge graph completion (HR-KGC) problem, representing each network alert as a qualified statement (h, r, t, Q), where h and t are source and destination IPs, r denotes the attack type, and Q encodes flow-level metadata such as timestamps, ports, protocols, and attack intensity, going beyond standard KGC binary triples (h, r, t) that would discard this contextual richness. We introduce five models across three contributions: first, Hyper-relational Neural Bellman-Ford (HR-NBFNet) extends Neural Bellman-Ford Networks to the hyper-relational setting with qualifier-aware multi-hop path reasoning, while its multi-task variant MT-HR-NBFNet jointly predicts tail, relation, and qualifier-value within a single traversal pass; second, AlertStar fuses qualifier context and structural path information entirely in embedding space via cross-attention and learned path composition, and its multi-task extension MT-AlertStar eliminates the overhead of full knowledge graph propagation; third, HR-NBFNet-CQ extends qualifier-aware representations to answer complex first-order logic queries, including one-hop, two-hop chain, two-anchor intersection, and union, enabling multi-condition threat reasoning over the alert knowledge graph. Evaluated inductively on the Warden and UNSW-NB15 benchmarks across three qualifier-density regimes, AlertStar and MT-AlertStar achieve superior MR, MRR, and Hits@k, demonstrating that local qualifier fusion is both sufficient and more efficient than global path propagation for hyper-relational alert prediction.
Abstract (translated)
网络攻击的规模与复杂性持续增长，但现有网络入侵检测方法在攻击者-受害者交互的路径推理上缺乏所需的语义深度。本研究通过以下方式解决该问题：首先将网络告警建模为知识图谱，进而将超关系告警预测形式化为超关系知识图谱补全（HR-KGC）问题，将每个网络告警表示为限定语句（h, r, t, Q），其中h与t分别为源IP与目的IP，r表示攻击类型，Q则编码流级元数据（如时间戳、端口、协议及攻击强度），超越了会丢弃此类上下文信息的标准KGC二元三元组（h, r, t）。我们提出五个模型，涵盖三项核心贡献：第一，超关系神经贝尔曼-福特网络（HR-NBFNet）将神经贝尔曼-福特网络扩展至超关系场景，实现感知限定符的多跳路径推理，其多任务变体MT-HR-NBFNet可在单次遍历中联合预测尾实体、关系及限定符值；第二，AlertStar通过交叉注意力与学习路径组合，完全在嵌入空间内融合限定符上下文与结构路径信息，其多任务扩展MT-AlertStar消除了完整知识图谱传播的开销；第三，HR-NBFNet-CQ将感知限定符的表示扩展至复杂一阶逻辑查询应答，包括单跳、双跳链式、双锚点交集与并集查询，从而支持对告警知识图谱的多条件威胁推理。在Warden与UNSW-NB15基准的三种限定符密度情境下进行归纳评估，AlertStar与MT-AlertNet在MR、MRR及Hits@k指标上表现最优，证明局部限定符融合对于超关系告警预测既充分且比全局路径传播更高效。
URL
https://arxiv.org/abs/2604.03104
