Malicious traffic classification and identification method, system and device based on graph convolutional neural network, and medium

Abstract

The invention discloses a malicious traffic classification and identification method, system and device based on a graph convolutional neural network, and a medium. The method comprises the steps of obtaining a data packet, cleaning data, extracting statistical traffic features of the data, and forming a stream sequence; performing detection and pre-classification on the flow sequence; converting the detected and pre-classified flow sequence into a flow grayscale image; inputting the detected and pre-classified traffic grayscale image into an image convolutional neural network for training, and constructing a malicious traffic classification and recognition model for deep classification and recognition; and adopting the trained malicious traffic classification and identification model to carry out deep classification and identification on the network traffic. According to the method and the device, the malicious traffic conforming to the characteristics can be more accurately screened out from a large number of traffic packets mixed with the malicious traffic.

Description

Technical Field

[0001] The present invention relates to the field of information security and intrusion detection, and in particular to a method, system, device and medium for classifying and identifying malicious traffic based on a graph convolutional neural network. Background Art

[0002] With the increasing complexity of network traffic, malicious network attacks have become more diverse, complex, and hidden. This poses a huge threat and impact on cyberspace. How to quickly and efficiently detect malicious traffic in a complex network environment? Malicious traffic detection methods have gradually shifted from traditional detection methods based on traffic load characteristics and abnormal feature library matching to methods based on machine learning and deep learning.

[0003] With the rapid development of artificial intelligence and machine learning, the use of machine learning to detect malicious traffic has become a new research direction. However, machine learning methods rely more on professionals to design and mark traffic features, and cannot automatically and quickly adapt to the current speed of network changes. However, deep learning methods can automatically read and analyze data through the connections between neurons in its neural network, extracting effective deep behavioral features, and have become an effective method for detecting malicious traffic in the current network environment.

[0004] Traditional deep packet inspection mainly relies on the deep content of the identified network packets to identify and classify traffic. The main detection methods can be roughly divided into: matching and identifying the patterns and signatures of known malicious traffic. Detailed analysis of the behavioral characteristics of data packets and network traffic, and detecting and identifying possible malicious behaviors by detecting their connection frequency and data transmission mode. Matching known malicious traffic by the original destination port of the data packet and the protocol type used, extracting statistical features of the traffic, including packet size and session duration, and classifying such features. However, the inherent problem of this identification method is that the identification rules are not updated in a timely manner, and potential malicious behaviors cannot be detected. It is impossible to effectively identify newly emerging malicious traffic, the detection performance for encrypted traffic is limited, and the overall adaptability to emerging malware and attack patterns is insufficient.

[0005] The traditional intrusion detection system based on abnormal feature library matching is also the most commonly used method by many Internet manufacturers today. It relies on a set of pre-defined abnormal features or signatures to identify malicious behavior in the network. Use a network bypass device, a network sniffer, to capture data packets passing through the network. Analyze the captured data packets and extract the traffic features, original destination address, port number, protocol type, etc. Match the extracted features with the sample library to find known malicious patterns and attack signatures. Once a matching feature is detected, an alarm is triggered immediately. At the same time, there will be a suitable UI interface to generate corresponding detection log records, and generate analysis reports based on various data information. Summary of the invention

[0006] The purpose of the present invention is to provide a method, system, device and medium for classifying and identifying malicious traffic based on a graph convolutional neural network (GCN), so as to overcome the inherent problems of traditional deep packet inspection and intrusion detection based on matching of abnormal feature libraries, and the problem that classical machine learning relies too much on a suitable set of labeled features.

[0007] The first aspect of the present application provides a method for classifying and identifying malicious traffic based on a graph convolutional neural network, comprising the following steps:

[0008] Get data packets, clean the data, extract the statistical traffic features of the data, and form a flow sequence;

[0009] Detect and pre-classify the flow sequence;

[0010] Convert the flow sequence after detection and pre-classification into a flow grayscale image;

[0011] The pre-classified traffic grayscale image is input into the graph convolutional neural network for training, and a malicious traffic classification and recognition model for deep classification and recognition is constructed;

[0012] Use the trained malicious traffic classification and identification model to perform deep classification and identification of network traffic.

[0013] To optimize the above technical solutions, the specific measures taken also include:

[0014] The data packets are from selected public malicious traffic data sets on the Internet and attack traffic data sets that are actively captured or created.

[0015] Furthermore, the statistical flow characteristics of the extracted data are formed into a flow sequence, specifically: analyzing the size of the data packet, the time interval and the duration to extract the spatiotemporal characteristics of the network traffic and form a flow sequence containing multiple features for classification and identification.

[0016] Furthermore, the detection and pre-classification of the flow sequence is as follows: using predefined rules and pattern matching to preliminarily classify network behaviors, protocol features and abnormal behavior indicators, and using a logistic regression algorithm to output pre-classification prediction results.

[0017] Furthermore, the flow sequence is processed and converted into a flow grayscale image, specifically: the binary format data of the flow sequence is divided into data session units, the data session units are numerically converted, all the converted values ​​are mapped to image pixels, and a grayscale image is constructed.

[0018] Furthermore, the grayscale image of the traffic detected and pre-classified is input into the graph convolutional neural network for training to construct a malicious traffic classification and recognition model for deep classification and recognition, specifically:

[0019] A semi-supervised learning method is used to train and process the flow grayscale image after detection and pre-classification using a graph convolutional neural network. The graph convolutional neural network model uses a ReLU activation function, sets the corresponding weights of the filter and the convolution kernel, and performs a corresponding feature value bias on the output of each convolution layer to obtain the corresponding output of each layer; after each convolution layer, a corresponding maximum pooling layer is set; TopKPooling is used to perform maximum pooling on the features to obtain global maximum pooling and global average pooling features, and the output of each maximum pooling layer is calculated;

[0020] After the last maximum pooling layer, add a recurrent neural network layer LSTM to merge the input and processing results; the recurrent neural network layer LSTM uses the gating unit to control the network loop and update the state. According to each maximum pooling layer output, the input gate, output gate and forget gate are updated in time steps, and the bias, input and loop weights are set so that each layer obtains updated information content;

[0021] The final output of the LSTM layer of the recurrent neural network is input to the fully connected layer, processed by the linear layer Linear and batch normalization, classified using the softmax classifier, and the classification result is obtained through the final output layer to achieve binary differentiation of network traffic.

[0022] The network traffic is divided into training set, validation set and test set; the training set is used to train the malicious traffic classification and identification model, the binary classification loss function is calculated for the classification results, and the positive and negative classes are judged by positive and negative values; the gradient descent optimization algorithm is used to update the model parameters, the validation set is used to verify and tune the model, and the test set is used to obtain the final classification results.

[0023] The second aspect of the present application provides a malicious traffic classification and identification system based on a graph convolutional neural network, comprising:

[0024] The data acquisition module is used to acquire data packets, clean the data, extract the statistical flow characteristics of the data, and form a flow sequence;

[0025] Image conversion module, used to detect and pre-classify stream sequences;

[0026] The pre-classification module is used to detect and pre-classify the traffic grayscale image.

[0027] The flow conversion module is used to convert the flow sequence after detection and pre-classification into a flow grayscale image;

[0028] A malicious traffic classification and identification model building module is used to input the pre-classified traffic grayscale image into the graph convolutional neural network for training, and to build a malicious traffic classification and identification model for deep classification and identification;

[0029] The classification and identification module is used to perform deep classification and identification of network traffic using the trained malicious traffic classification and identification model.

[0030] The third aspect of the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the malicious traffic classification and identification method based on a graph convolutional neural network as described above is implemented.

[0031] The fourth aspect of the present application provides a computer-readable storage medium storing a computer program, wherein the computer program enables a computer to execute the malicious traffic classification and identification method based on a graph convolutional neural network as described above.

[0032] Compared with the prior art, the present invention has the following beneficial effects:

[0033] The present invention processes network traffic data into a grayscale graph, extracts spatial features through a graph convolutional neural network, fully learns the generated network traffic grayscale graph, extracts traffic time features and classifies them after multiple rounds of iterations, thereby realizing anomaly detection.

[0034] The present invention makes full use of the spatiotemporal characteristics of network traffic, establishes a flow sequence containing more features for identification, fully considers the spatiotemporal characteristics, statistical characteristics and structural characteristics of network traffic, and establishes a graph model of the flow.

[0035] The present invention converts network traffic into a grayscale image, uses a graph convolutional neural network (GCN) to extract the spatial characteristics of the traffic, and converts the network traffic into a graph structure, which can comprehensively consider all overall and local features between the traffic; after fully identifying all features and local pattern structures, multiple rounds of iterations or recurrent neural networks are used to extract features in the time domain, effectively processing time series data so that temporal dependencies can be captured.

[0036] The present invention adopts a graph convolutional neural network. Compared with general deep neural networks, graph convolutional neural networks have the characteristics of local connection, weight sharing and pooling operation, and have strong spatial feature learning ability. The present invention adds self-connected weights to the neurons in the middle layer, so that each round of training can record the state information of the previous training, thereby realizing the ability to save sequence information.

[0037] During the training process of the entire model, the present invention not only uses a single malicious traffic to perform malicious traffic identification and classification, but also includes artificially created and captured normal network access traffic and a series of malicious traffic created for various types of network attacks, so as to perform overall training processing on the entire complex network traffic packet, and finally realize the judgment of complex network traffic, and can more accurately screen out malicious traffic that meets the characteristics from a large number of traffic packets mixed with malicious traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 :Flowchart of the malicious traffic classification and identification method based on graph convolutional neural network of the present invention.

[0039] Figure 2 : The present invention constructs a flow chart of a malicious traffic classification and identification model.

[0040] Figure 3 : Flowchart of data packet processing of the present invention. DETAILED DESCRIPTION

[0041] The above contents of the present invention are further described in detail below in the form of embodiments, but this should not be understood as the scope of the above subject matter of the present invention being limited to the following embodiments, and all technologies realized based on the above contents of the present invention belong to the scope of the present invention.

[0042] In one embodiment of the present invention, a method for classifying and identifying malicious traffic based on a graph convolutional neural network is proposed. Figure 1 As shown, the present invention marks possible malicious behaviors in the original traffic through pre-classification processing, and can discover possible problems in the communication mode by analyzing the time and space characteristics contained in its image; the binary data packet network traffic is converted into a two-dimensional grayscale image that is more convenient for machines to recognize and learn, and the effect of converting the traffic into a grayscale image is achieved by cleaning and preprocessing the data; the grayscale image is then placed in a set graph convolutional neural network for iterative training of the model, and after convolution and pooling operations, the obtained sample output is placed in a recurrent neural network LSTM, and the result sequence is processed and finally placed in softmax for binary differentiation processing to achieve classification of network traffic.

[0043] The method flow of the present invention is as follows Figure 2 As shown, the following steps are included:

[0044] Get data packets, clean the data, extract the statistical traffic features of the data, and form a flow sequence;

[0045] Detect and pre-classify the flow sequence;

[0046] Convert the flow sequence after detection and pre-classification into a flow grayscale image;

[0047] The pre-classified traffic grayscale image is input into the graph convolutional neural network for training, and a malicious traffic classification and recognition model for deep classification and recognition is constructed;

[0048] Use the trained malicious traffic classification and identification model to perform deep classification and identification of network traffic.

[0049] The packets come from selected public malicious traffic datasets on the Internet, as well as attack traffic datasets that are actively captured or created.

[0050] Extract statistical traffic features of data to form flow sequences. Specifically, analyze the packet size, time interval and duration to extract the spatiotemporal characteristics of network traffic and form a flow sequence containing multiple features for classification and identification.

[0051] The detection and pre-classification of flow sequences is as follows: using conventional pre-defined rules and pattern matching to preliminarily classify network behaviors, protocol features, and abnormal behavior indicators, and using a logistic regression algorithm to output pre-classification prediction results.

[0052] The flow sequence is processed and converted into a flow grayscale image. Specifically, the binary format data of the flow sequence is divided into data session units, the data session units are numerically converted, all the converted values ​​are mapped to image pixels, and a grayscale image is constructed.

[0053] The pre-classified traffic grayscale image is input into the graph convolutional neural network for training, and a malicious traffic classification and recognition model for deep classification and recognition is constructed. Specifically:

[0054] The present invention uses a semi-supervised learning method and adopts a graph convolutional neural network to train and process the flow grayscale image after detection pre-classification. The graph convolutional neural network model adopts the ReLU activation function, sets the corresponding weights of the filter and the convolution kernel, and performs a corresponding feature value bias on the output of each convolution layer to obtain the corresponding output of each layer; after each convolution layer, a corresponding maximum pooling layer is set; TopKPooling is used to perform maximum pooling on the features to obtain the global maximum pooling and global average pooling features, and the output of each maximum pooling layer is calculated;

[0055] After the last maximum pooling layer, add a recurrent neural network layer LSTM to merge the input and processing results; the recurrent neural network layer LSTM uses the gating unit to control the network loop and update the state. According to each maximum pooling layer output, the input gate, output gate and forget gate are updated in time steps, and the bias, input and loop weights are set so that each layer obtains updated information content;

[0056] The final output of the LSTM recurrent neural network layer is input to the fully connected layer, processed by the linear layer and batch normalization, classified using the softmax classifier, and the classification result is obtained through the final output layer to achieve binary differentiation of network traffic.

[0057] Specifically, the graph convolutional neural network converts network traffic into a graph structure, where nodes represent specific features of traffic and edges represent the correlation between traffic.

[0058] The network traffic is divided into training set, validation set and test set; the training set is used to train the malicious traffic classification and identification model, the binary classification loss function is calculated for the classification results, and the positive and negative classes are judged by positive and negative values; the gradient descent optimization algorithm is used to update the model parameters, the validation set is used to verify and tune the model, and the test set is used to obtain the final classification results.

[0059] The present invention extracts the temporal and spatial characteristics of the overall network traffic by analyzing the size, time interval, duration and other information of the corresponding data packets, such as: using a single network data stream to extract the specific information of each data stream, including the total amount of data packets, number of bytes, port number and other information; performing a specific analysis of the handshake phase of protocols such as TLS / SSL to grasp the corresponding version number and key length; and obtaining extractable plaintext information from the encrypted data traffic. Finally, the original traffic data packet is directly converted into an image pattern for identification and retrieval, so that users can extract the temporal and spatial characteristics it contains.

[0060] The present invention preliminarily classifies the indicators of existing network behaviors, protocol features and abnormal behaviors; determines the significant differences from normal traffic patterns and marks the possible malicious behaviors; although malicious traffic may not be accurately detected and encrypted traffic may be difficult to extract features, the preliminary classification still improves the overall efficiency; the present application uses a logistic regression algorithm, such as the sigmoid function, to map the output of linear regression to between 0 and 1, perform binary classification prediction, simply determine whether it is malicious traffic, and preliminarily perform pre-classification.

[0061] The present invention uses predefined rules and pattern matching to detect and identify original traffic and perform pre-classification, mainly to preliminarily classify the traffic into two types of packets: one type is TCP SYN packet, which is the first initialization connection step for establishing a TCP link. Network attackers can also send a large number of such SYN packets for detection, preliminarily try to attack the target system or start a DDos attack; the main detection method used is to identify the number of all SYN packets received within a period of time. Once the number exceeds this threshold, it will be determined that there is a potential scanning or attack risk; the second type is UDP unicast packet, this connection is point-to-point communication, no multiple connections are required, but attackers may send a large number of forms in this way; the main detection method is to detect the total flow of UDP unicast data packets in the entire network; the feature recognition adopted by the detection methods of these two data packets is different. In order to improve the overall recognition efficiency, this method is selected to perform comprehensive analysis and generate pre-classification results.

[0062] For a group of network traffic packets, the detected and identified normal behavior data (negative samples) is much larger than the abnormal or malicious behavior traffic (positive samples). Therefore, such a pre-classification is also convenient for further processing of the traffic data set. The threshold of the subsequent classifier can be adjusted accordingly, which can effectively improve the detection and identification capabilities of small sample traffic. And this classification result will be used as a reference to reduce the proportion of most sample classes in the training set.

[0063] The present invention combines the results of attack traffic of different data packet types after conversion by a graph convolutional neural network, extracts relevant features, forms a model with relatively high full-relative recognition and detection efficiency, and compares it with the view generated by the detection traffic processed by the graph convolutional neural network to improve the accuracy of the overall classification. The graph convolutional neural network is used to process the graph structure of network traffic, which is convenient for extracting complex network traffic and representing it in a simplified way. A semi-supervised learning method is used to train a large amount of unlabeled data with a small amount of labeled data sets to improve the generalization ability of the overall model. Finally, multi-party judgments are combined to fuse feature forms from different sources, including protocol features in the original traffic, so that the model can more accurately judge the traffic type and improve the accuracy of the entire model.

[0064] The present invention is further described in detail below in conjunction with specific embodiments:

[0065] The malicious traffic classification and identification method based on graph convolutional neural network in this embodiment is as follows: Figure 3 As shown, including:

[0066] (1) Data cleaning and grayscale image generation

[0067] After grouping the data packets based on the quintuple, a fixed number of data packets are selected in each group as a sample; then the samples are anonymized to eliminate data packets with the same MAC address and IP address in the same network environment to prevent adverse effects on the final classification; the communication frequencies of multiple protocols such as ARP, IP, TCP, UDP, HTTP, HTTPS, etc. are used as a standard for distinction; a simple detection pre-classification is performed on the TCP SYN packet frequency and UDP unicast packet detection; the anonymized samples are processed with a unified length according to the fixed number of bytes required; the length selection is related to the overall structure of the graph convolutional neural network used this time. If the number of bytes of the data packet is greater than the required length, the sample is truncated and the number of bytes in the header is taken; if it is less than the byte number requirement, the hexadecimal number "0x00" is used for byte padding; and finally a grayscale image suitable for deep neural network input is generated.

[0068] (2) Design of graph convolutional neural network and recurrent neural network LSTM

[0069] The obtained grayscale samples are input into the neural network model for training to build the model; the graph convolution layer is put into the ReLU activation function for activation; the ImbalancedSampler is used to collect unbalanced data for the training set, and the training and test data loaders are created; the input value of the sample image is obtained by constructing multiple decimal values; the decimal value of each byte is input into the first layer of the graph convolutional neural network to obtain the corresponding eigenvalue as the output of the first training. The present invention chooses to use the ReLU activation function to set the corresponding weights of the filter and the convolution kernel; the output of each convolution layer is biased with the corresponding eigenvalue to obtain the corresponding output of each layer.

[0070] After each convolutional layer, a corresponding maximum pooling layer is set to reduce the training computational complexity of the entire neural network model, reduce the corresponding network parameters, maximize computational efficiency, and prevent model overfitting. Use TopKPooling to perform maximum pooling on features to obtain global maximum pooling and global average pooling features. Correspondingly, after the output of each maximum pooling layer, corresponding computable outputs are obtained.

[0071] After the last maximum pooling layer, add a recurrent neural network layer LSTM. The input sequence and the processing result are merged through the recurrent network layer to better obtain the pattern of network traffic, and can well view the information contrast in network traffic with a long time span and the information status carried by the entire network traffic. LSTM controls the entire network cycle and update state by using its gating unit. According to the output of each maximum pooling layer, the input gate, output gate and forget gate are updated in time steps, and the corresponding bias, input and recurrent weights are set. Each layer will obtain new information status content.

[0072] The final output of LSTM is input into the fully connected layer through the linear layer and batch normalization processing, and classified using the softmax classifier. Finally, the result is put into the final output layer to obtain the classification result, realizing the binary differentiation of network traffic.

[0073] (3) Dataset Partitioning and Network Traffic Capture

[0074] In the design training process, multiple rounds of training are adopted. The training network traffic is divided into training set, validation set and test set. The training set is used to train the neural network model, and the binary classification loss function is calculated for the classification results. Positive and negative classes are judged by positive and negative values. The gradient descent optimization algorithm is used to update the neural network model parameters. The validation set is used to verify and tune the model, and the test set is used to obtain the final classification results.

[0075] In this specific embodiment, in addition to using test data sets commonly used in traditional neural networks and other similar types for comparison, malicious traffic is collected from the gateway and saved offline in pcap format, attack traffic is manually generated, and network traffic is captured at the same time; the original traffic is cleaned, outliers are discarded, and missing values ​​are filled; the processed traffic is divided into data streams with the same source IP, destination IP, original port, destination port and protocol, and the training model is used to autonomously learn about this type of attack; the final results show that the experiment has good experimental results in accuracy, precision and recall.

[0076] In addition to using common data sets of malicious traffic in the traditional sense, including KDD99 and CIC-IDS-2017, to train and test the model, the present invention independently manufactured and captured a certain amount of normal traffic, and manually performed target penetration attacks, capturing a variety of attack traffic including Dos attack traffic, client identity authentication attacks and common SQL injection attacks. After anonymizing the captured normal and abnormal mixed network traffic, the traffic was processed and converted into a grayscale image using different methods of generating network traffic with different granularities. The obvious difference between benign and abnormal network traffic can be clearly found, which provides intuitive evidence for the performance superiority of the neural network model.

[0077] By using common data sets for malicious traffic identification in neural networks for training and comparison, the KDD99 network traffic data set containing 41 traffic features and the CIC-IDS-2017 data set containing more than 80 traffic features such as packet size, packet interval time, flag bit, etc., the results show that both have achieved good results in the field of network traffic classification.

[0078] In another embodiment, the present invention proposes a malicious traffic classification and identification system based on a graph convolutional neural network, comprising:

[0079] The data acquisition module is used to acquire data packets, clean the data, extract the statistical flow characteristics of the data, and form a flow sequence;

[0080] Image conversion module, used to detect and pre-classify stream sequences;

[0081] The pre-classification module is used to detect and pre-classify the traffic grayscale image.

[0082] The flow conversion module is used to convert the flow sequence after detection and pre-classification into a flow grayscale image;

[0083] A malicious traffic classification and identification model building module is used to input the pre-classified traffic grayscale image into the graph convolutional neural network for training, and to build a malicious traffic classification and identification model for deep classification and identification;

[0084] The classification and identification module is used to perform deep classification and identification of network traffic using the trained malicious traffic classification and identification model.

[0085] In another embodiment, the present invention proposes an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the malicious traffic classification and identification method based on the graph convolutional neural network as described above is implemented.

[0086] In another embodiment, the present invention proposes a computer-readable storage medium storing a computer program, which enables a computer to execute the above-mentioned malicious traffic classification and identification method based on graph convolutional neural network.

[0087] In the embodiments disclosed in the present application, the computer storage medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. The computer storage medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the above. More specific examples of computer storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above.

[0088] Compared with the traditional botnet traffic classification detection method, the present invention first performs a simple pre-classification of TCP SYN packet frequency and UDP unicast packet detection, and then performs detailed classification based on this pre-classification. In addition, the training and detection data set is not only the traditional botnet traffic, but also includes artificially created and captured normal network access traffic and a series of malicious traffic created for various types of network attacks, including but not limited to SQL injection, XSS attack, authentication unauthorized attack traffic and other attack traffic. Compared with single botnet traffic training and testing, the present invention is more authentic and applicable.

[0089] The present invention is a further strengthening of the prevention of traditional intrusion detection systems. It can be called an advanced method based on machine learning, which can better improve the accuracy and adaptability of overall detection. To a certain extent, it can defend against the most difficult type of attack in network security - 0Day vulnerability, effectively making up for the possible limitations of traditional intrusion detection technology, and can defend against the detection of encrypted traffic to a certain extent, and can also adapt to new malware and attacks. In the continuous optimization, the overall detection accuracy and efficiency can also be continuously improved.

[0090] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in any form. Any technician familiar with the profession, without departing from the scope of the technical solution of the present invention and based on the technical essence of the present invention, may make any simple modifications, equivalent substitutions and improvements to the above embodiments, which are still within the protection scope of the technical solution of the present invention.

Claims

1. A method for classifying and identifying malicious traffic based on graph convolutional neural networks, characterized in that: The following steps are involved: Get data packets, clean the data, extract the statistical traffic features of the data, and form a flow sequence; Detect and pre-classify the flow sequence; Convert the flow sequence after detection and pre-classification into a flow grayscale image; The pre-classified traffic grayscale image is input into the graph convolutional neural network for training, and a malicious traffic classification and recognition model for deep classification and recognition is constructed; Use the trained malicious traffic classification and identification model to perform deep classification and identification of network traffic.

2. The method for classifying and identifying malicious traffic based on graph convolutional neural network according to claim 1 is characterized in that: The data packets are from selected public malicious traffic data sets on the Internet and attack traffic data sets that are actively captured or created.

3. The method for classifying and identifying malicious traffic based on graph convolutional neural network according to claim 1 is characterized in that: The statistical flow characteristics of the extracted data are formed into a flow sequence, specifically: analyzing the size, time interval and duration of the data packet to extract the spatiotemporal characteristics of the network flow and form a flow sequence containing multiple characteristics for classification and identification.

4. The method for classifying and identifying malicious traffic based on graph convolutional neural network according to claim 1 is characterized in that: The detection and pre-classification of the flow sequence is as follows: preliminarily classifying the network behavior, protocol features and abnormal behavior indicators by using predefined rules and pattern matching, and outputting the pre-classification prediction results by using a logistic regression algorithm.

5. The method for classifying and identifying malicious traffic based on graph convolutional neural network according to claim 1 is characterized in that: The processing of the flow sequence to convert it into a flow grayscale image is specifically as follows: dividing the flow sequence binary format data into data session units, performing numerical conversion on the data session units, mapping all converted numerical values ​​to image pixels, and constructing a grayscale image.

6. The method for classifying and identifying malicious traffic based on graph convolutional neural network according to claim 1 is characterized in that: The grayscale image of the traffic after detection and pre-classification is input into the graph convolutional neural network for training, and a malicious traffic classification and recognition model for deep classification and recognition is constructed, specifically: A semi-supervised learning method is used to train and process the flow grayscale image after detection and pre-classification using a graph convolutional neural network. The graph convolutional neural network model uses a ReLU activation function, sets the corresponding weights of the filter and the convolution kernel, and performs a corresponding eigenvalue bias on the output of each convolution layer to obtain the corresponding output of each layer; After each convolutional layer, a corresponding maximum pooling layer is set; Use TopKPooling to perform maximum pooling on the features, obtain the global maximum pooling and global average pooling features, and calculate the output of each maximum pooling layer; After the last maximum pooling layer, add a recurrent neural network layer LSTM to merge the input and processing results; the recurrent neural network layer LSTM uses the gating unit to control the network loop and update the state. According to each maximum pooling layer output, the input gate, output gate and forget gate are updated in time steps, and the bias, input and loop weights are set so that each layer obtains updated information content; The final output of the LSTM layer of the recurrent neural network is input to the fully connected layer, processed by the linear layer Linear and batch normalization, classified using the softmax classifier, and the classification result is obtained through the final output layer to achieve binary differentiation of network traffic.

7. The method for classifying and identifying malicious traffic based on graph convolutional neural network according to claim 1 is characterized in that: The network traffic is divided into training set, validation set and test set; the training set is used to train the malicious traffic classification and identification model, the binary classification loss function is calculated for the classification results, and the positive and negative classes are judged by positive and negative values; the gradient descent optimization algorithm is used to update the model parameters, the validation set is used to verify and tune the model, and the test set is used to obtain the final classification results.

8. A malicious traffic classification and identification system based on graph convolutional neural network, characterized in that: include: The data acquisition module is used to acquire data packets, clean the data, extract the statistical flow characteristics of the data, and form a flow sequence; Image conversion module, used to detect and pre-classify stream sequences; The pre-classification module is used to detect and pre-classify the traffic grayscale image. The flow conversion module is used to convert the flow sequence after detection and pre-classification into a flow grayscale image; A malicious traffic classification and identification model building module is used to input the pre-classified traffic grayscale image into the graph convolutional neural network for training, and to build a malicious traffic classification and identification model for deep classification and identification; The classification and identification module is used to perform deep classification and identification of network traffic using the trained malicious traffic classification and identification model.

9. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method for classifying and identifying malicious traffic based on a graph convolutional neural network as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, wherein the computer program enables a computer to execute the malicious traffic classification and identification method based on a graph convolutional neural network as described in any one of claims 1 to 7.

Images