Network Security Anomaly Detection Algorithm and Detection System Based on Clustering Graph Neural Network

Abstract

The invention discloses a network security anomaly detection algorithm based on a cluster graph neural network. The algorithm includes the following steps: using a graph model to describe the network topology, using a graph neural network convolutional layer to optimize node features, using a graph clustering algorithm to divide the graph into multiple disjoint subgraphs, and treating each subgraph as a node, The adjacency relationship of the subgraph is regarded as an edge to form a subgraph, and the graph attention layer is used to learn a weight for each node, and the features of all nodes in each subgraph are weighted and summed to form the characteristics of the nodes in the subgraph, and finally Use the fully connected layer and the classifier layer to judge whether the network has received an attack. This method builds a hierarchical graph neural network, optimizes the node features in the graph through the graph convolution layer, captures local features on the graph through the pooling layer based on the graph clustering algorithm, and generates high-level semantic features. The situational features of the entire network are generated, and the network situation is classified by a classifier.

Description

technical field [0001] The invention belongs to the field of network security anomaly detection. Specifically, the invention uses a graph model to describe the topology structure of the network, and uses a hierarchical graph neural network model to detect whether there is an anomaly in the entire network. Background technique [0002] With the advancement of information technology, both enterprises and individuals are enjoying the convenience brought by information technology. As a part of information technology, network technology is widely used in daily life. With the increasing number of cyber attacks in recent years, the means of attack are becoming more and more diversified and concealed. By judging information such as the operating status and logs of a single device, it is difficult to discover hidden complex attacks. How to reasonably and effectively use the information of all devices in the entire network to comprehensively judge whether the entire network has rece...

AI Technical Summary

Problems solved by technology

It is difficult to discover hidden complex attacks by judging the operating status and logs of a single device

Images