Temporal Multi-Query Subgraph Matching in Cybersecurity

Abstract

Regarding attack scenarios as query graphs and conducting subgraph matching on the data system is an important approach to identify and detect cyber threats. However, existing subgraph matching methods are not suitable for detecting time-evolving attacks since they either focus on single-query graphs or ignore the temporal constraints between multiple queries. In this paper, we model the time-evolving attack detection as a novel temporal multi-query subgraph matching problem and propose an efficient algorithm to address this problem. We first give a compact representation of the temporal query graph by merging all queries into one. Based on the temporal query graph, we propose a concise auxiliary data structure to maintain partial solutions. In addition, we employ a query matching tree to generate an efficient matching order and enumerate matchings based on the order. Extensive experiments over real-world datasets confirm the effectiveness and efficiency of our approach.