中图分类号：TP393.08文献标志码：ADOI:10.19358/j.issn.2097-1788.2026.04.007
中文引用格式：胡开明，陈建华. 一种融合多源异构数据的图神经网络联合框架［J］.网络安全与数据治理，2026，45（4）：51-58.
英文引用格式：Hu Kaiming，Chen Jianhua. A joint framework of graph neural networks integrating multisource heterogeneous data［J］.Cyber Security and Data Governance，2026，45（4）：51-58.

A joint framework of graph neural networks integrating multisource heterogeneous data

Abstract： Aiming at the complex characteristics of cyberspace attackdefense confrontation, such as multistep, concealed, and heterogeneous, traditional methods relying on rule matching and statistical analysis can hardly meet the needs of accurate traceability and realtime situation awareness. This paper proposes a joint framework of graph neural networks (GNNs) integrating multisource heterogeneous data to realize automatic traceability of network attacks and dynamic situation awareness. Firstly, a heterogeneous information network (HIN) of network entitiesattack behaviors is constructed to integrate multisource data such as traffic logs, vulnerability databases, and alarm information. Secondly, a spatiotemporal graph attention network (STGAT) based on the attention mechanism is designed to capture the temporal dependence of attack behaviors and the correlation characteristics of nodes. Finally, through attack path reasoning and risk level quantification, a closed loop from attack traceability to situation assessment is formed. Experiments are verified based on the CTU13 and CSECICIDS2018 datasets. The results show that the framework is significantly superior to traditional methods, the mainstream temporal GNN variants and dedicated models in the field of network security in indicators such as attack traceability accuracy (92.7%) and situation assessment response time (≤0.3 s), providing technical support for network security emergency response.

Key words : Graph Neural Network (GNN); network attack traceability; situation awareness; Heterogeneous Information Network (HIN); Spatiotemporal Graph Convolution(SGC)