中圖分類號：TP393.08文獻標志碼：ADOI:10.19358/j.issn.2097-1788.2026.04.007
中文引用格式：胡開明，陳建華. 一種融合多源異構數據的圖神經網絡聯合框架［J］.網絡安全與數據治理，2026，45（4）：51-58.
英文引用格式：Hu Kaiming，Chen Jianhua. A joint framework of graph neural networks integrating multisource heterogeneous data［J］.Cyber Security and Data Governance，2026，45（4）：51-58.

A joint framework of graph neural networks integrating multisource heterogeneous data

Abstract： Aiming at the complex characteristics of cyberspace attackdefense confrontation, such as multistep, concealed, and heterogeneous, traditional methods relying on rule matching and statistical analysis can hardly meet the needs of accurate traceability and realtime situation awareness. This paper proposes a joint framework of graph neural networks (GNNs) integrating multisource heterogeneous data to realize automatic traceability of network attacks and dynamic situation awareness. Firstly, a heterogeneous information network (HIN) of network entitiesattack behaviors is constructed to integrate multisource data such as traffic logs, vulnerability databases, and alarm information. Secondly, a spatiotemporal graph attention network (STGAT) based on the attention mechanism is designed to capture the temporal dependence of attack behaviors and the correlation characteristics of nodes. Finally, through attack path reasoning and risk level quantification, a closed loop from attack traceability to situation assessment is formed. Experiments are verified based on the CTU13 and CSECICIDS2018 datasets. The results show that the framework is significantly superior to traditional methods, the mainstream temporal GNN variants and dedicated models in the field of network security in indicators such as attack traceability accuracy (92.7%) and situation assessment response time (≤0.3 s), providing technical support for network security emergency response.

Key words : Graph Neural Network (GNN); network attack traceability; situation awareness; Heterogeneous Information Network (HIN); Spatiotemporal Graph Convolution(SGC)