Intrusion detection method and device based on graph neural network, and medium

Abstract

The invention discloses an intrusion detection method and device based on a graph neural network and a medium, and relates to the field of computer networks, and the method comprises the steps: constructing a graph structure according to network flow data in a current time window; the graph structure comprises a node set, an edge set, a node feature matrix, an edge feature matrix and an adjacent matrix; the adjacent matrix is used for representing a communication state between the nodes; inputting the graph structure corresponding to the current time window into a network node traffic type identification model to obtain the traffic type of each node; the network node traffic type identification model is obtained by training a preset graph neural network by adopting a training sample set; in a preset graph neural network, for an input graph structure, a Bi-LSTM layer is adopted to extract time feature information, and a graph convolution layer and a graph attention mechanism are combined to extract space feature information in a time dimension, so that a traffic type of each node is obtained. According to the invention, more accurate network intrusion detection is realized.

Description

Technical Field

[0001] The present application relates to the field of computer networks, and in particular to an intrusion detection method, device and medium based on graph neural network. Background Art

[0002] With the rapid development of information technology, computer networks have become the core infrastructure for the transmission, storage and processing of various types of information. However, the complexity and openness of the network environment make it vulnerable to various forms of network attacks, such as distributed denial of service attacks, malware propagation, data leakage, zero-day attacks, etc. These network attacks not only threaten personal privacy security, but also pose a major threat to the information security of enterprises and organizations. Therefore, network intrusion detection technology has become a key research topic in the field of network security.

[0003] Traditional intrusion detection systems usually detect known attack patterns based on feature matching or rule engines, but these methods have limited detection capabilities for unknown or variant attacks, and as the scale of network traffic continues to increase, they face problems such as excessive consumption of computing resources and high false alarm rates. In recent years, machine learning and deep learning technologies have gradually been applied to the field of intrusion detection, improving the detection capabilities of the system through automatic analysis and feature extraction of large-scale network traffic data. However, deep learning models such as convolutional neural networks and recurrent neural networks mainly rely on fixed-structure data representation, making it difficult to fully utilize the complex relationships and topological information in network traffic. Summary of the invention

[0004] The purpose of this application is to provide an intrusion detection method, device and medium based on graph neural network, which can achieve more accurate network intrusion detection.

[0005] To achieve the above objectives, this application provides the following solutions:

[0006] In a first aspect, the present application provides an intrusion detection method based on a graph neural network, comprising:

[0007] Acquire network traffic data in a current time window; wherein the network traffic data in the current time window overlaps with the network traffic data in a previous time window;

[0008] According to the network traffic data in the current time window, a graph structure is constructed; the graph structure includes a node set, an edge set, a node feature matrix, an edge feature matrix and an adjacency matrix; the nodes in the node set are used to represent network entities, the edges in the edge set are used to represent communication behaviors between nodes, and the adjacency matrix is ​​used to represent communication states between nodes;

[0009] The graph structure corresponding to the current time window is input into the network node traffic type recognition model to obtain the traffic type of each node; wherein the traffic type is normal traffic or attack traffic; the network node traffic type recognition model is obtained by training a preset graph neural network with a training sample set; in the preset graph neural network, for the input graph structure, the Bi-LSTM layer is used to extract time feature information, and then the graph convolution layer and the graph attention mechanism are combined to extract the spatial feature information in the time dimension to obtain the traffic type of each node.

[0010] In a second aspect, the present application provides a computer device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement an intrusion detection method based on a graph neural network.

[0011] In a third aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements an intrusion detection method based on a graph neural network.

[0012] According to the specific embodiments provided by the present application, the present application has the following technical effects: the present application provides an intrusion detection method, device and medium based on a graph neural network, in which a preset graph neural network is constructed, and in the network, for the input graph structure, a Bi-LSTM layer is used to extract time feature information, and then the graph convolution layer and the graph attention mechanism are combined to extract spatial feature information in the time dimension to obtain the traffic type of each node. In the present application, the basic features of the global graph structure are extracted by the graph convolution layer, and the graph attention mechanism is used to focus on the important neighbor node features and enhance the classification ability of the model. The combination of the above-mentioned graph convolution layer and the graph attention mechanism can more effectively capture the complex relationships and topological structures in the network traffic data, and then make more accurate detection of complex attack behaviors. The present application introduces the Bi-LSTM layer and the time window, so that the model trained by the present application has better adaptability and generalization ability when processing dynamic network traffic. Network attacks usually show the characteristics of dynamic changes. When the dynamic graph structure is processed by the scheme of the present application, the evolution trend of the traffic can be captured in the time series dimension, especially when detecting zero-day attacks and unknown attacks. Stronger robustness. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0014] Figure 1 This is an application environment diagram of an intrusion detection method based on a graph neural network in one embodiment of the present application;

[0015] Figure 2 A schematic diagram of a preset graph neural network provided in one embodiment of the present application;

[0016] Figure 3 A schematic diagram of a graph convolution block provided in an embodiment of the present application;

[0017] Figure 4 A schematic diagram of a flow chart of an intrusion detection method based on a graph neural network provided in one embodiment of the present application;

[0018] Figure 5 A schematic diagram of the structure of a computer device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0020] Research has found that Graph Neural Network (GNN) can effectively process graph structure data, has the ability to capture complex relationships between nodes, aggregate local and global information, and is very suitable for processing network traffic data with complex topological structures. Based on this, this application takes advantage of the advantages of graph neural networks in processing complex relationships and topological structures, and uses a preset graph neural network to learn the features of nodes and edges in the graph structure of network traffic data, which can achieve efficient and accurate intrusion detection in the face of large-scale, dynamically changing network environments. In particular, the preset graph neural network combines the graph convolution layer with the graph attention mechanism, allowing this application to capture complex relationships in network traffic more effectively and accurately.

[0021] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0022] The intrusion detection method based on graph neural network provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be set up separately, integrated on the server 104, or placed on the cloud or other servers. The terminal 102 can send network traffic data within a certain period of time to the server 104, and the server 104 builds a graph structure based on the received data, and then inputs it into the network node traffic type identification model to obtain the traffic type of each node. The server 104 can feedback the traffic type of each node obtained to the terminal 102.

[0023] The terminal 102 may be, but is not limited to, various desktop computers, laptop computers, smart phones, tablet computers, IoT devices, and portable wearable devices. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers, or may be a cloud server.

[0024] In an exemplary embodiment, the present application provides an intrusion detection method based on a graph neural network, which converts network traffic data into a graph structure and uses a graph neural network for feature extraction and intrusion detection. Next, a detailed description is given from two aspects: graph neural network preparation and graph neural network application.

[0025] Preparation of graph neural network: Use the training sample set to train the preset graph neural network to obtain a network node traffic type recognition model. Research has found that in a real network environment, network traffic has the characteristics of dynamic change. In order to better capture the attack behavior that evolves over time in network traffic, this application uses dynamic graph processing technology to integrate the time dimension of network traffic into the graph neural network. The main task of this step is to construct a dynamic graph (or, to construct multiple training samples containing time dimension information) so that the neural network obtained by subsequent training can learn and detect based on the graph structure of different time segments, thereby realizing the detection of continuous or sudden attacks. To achieve the above purpose, the construction process of the training sample set in this application includes:

[0026] (201) Based on a sliding window, the historical network traffic data within a preset time length is divided into a plurality of continuous network traffic sample data; there is overlap between two adjacent network traffic sample data.

[0027] Specifically, the historical network traffic data is divided into time segments, each time segment represents a fixed time window (such as taking the time window as one minute), and the data in each time window can form a static graph structure according to the subsequent steps. Then the graph structures constructed in each time window are arranged in sequence to form a dynamic graph sequence. The graph structure corresponding to each time segment contains the network communication information of the current time segment. As time goes by, the graph structure and the feature information contained in the graph structure are continuously updated to form a constantly changing dynamic graph, which also reflects the dynamic characteristics of network traffic data.

[0028] In order to ensure the continuity of the dynamic graph, the sliding window mechanism allows partial overlap between the network traffic sample data corresponding to multiple time segments, thereby ensuring that the model can capture the dependency relationship between the previous and next time slices in each time window.

[0029] (202) Data cleaning is performed on multiple consecutive network traffic sample data respectively, so that each of the network traffic sample data includes the source IP address, destination IP address, source port number, destination port number, transmission protocol type and data packet size, and can also include basic information such as data packet arrival time, which can be added, deleted or adjusted as needed.

[0030] Specifically, the network traffic sample data captured by the network traffic collection tool contains some damaged or invalid data, which needs to be removed. Therefore, duplicate network traffic sample data is removed, incomplete network traffic sample data is deleted, and each network traffic sample data is ensured to have complete IP address, port number, protocol type and size and other field information. After data cleaning, only valid and usable data should be included.

[0031] (203) Label each network traffic sample data after data cleaning to obtain the corresponding traffic type of all nodes; specifically, manually label the network traffic log corresponding to the network traffic sample data by analyzing the network traffic log, and the labeled data set provides real labels for supervised learning.

[0032] (204) Perform feature extraction and format unification on each network traffic sample data after data cleaning to obtain the corresponding node set, edge set, node feature matrix, edge feature matrix and adjacency matrix, and form a graph structure sample; one of the graph structure samples and the corresponding traffic types of all nodes constitute a training sample, and multiple training samples constitute a training sample set.

[0033] Specifically, for each IP address in the network traffic sample data, the traffic statistics and communication features related to it are extracted. The traffic statistics include the number of sent data packets, the number of received data packets, the total amount of data transmitted, and the protocol distribution ratio; the communication features include the size of the data packet, the protocol type, and the transmission direction. In addition, the extracted feature data can be formatted into a data input format suitable for building a graph structure, including the communication relationship between the source IP and the destination IP, node features, edge features, etc.

[0034] The core of graph structure construction includes node set (representing hosts or IP addresses in the network), edge set (representing the communication relationship between nodes), node feature matrix, edge feature matrix and adjacency matrix. Among them, the node in the node set is any one of the source IP address, destination IP address, source port number and destination port number, representing the entity participating in network communication. The characteristics of the node include the traffic statistical characteristics related to the node. The following Table 1 is an example of a network traffic sample data.

[0035] Table 1

[0036]

[0037]

[0038] Based on the above network traffic sample data, four nodes can be obtained as follows: Node 1: 192.168.1.1; Node 2: 192.168.1.2; Node 3: 192.168.1.3; Node 4: 192.168.1.4.

[0039] Based on the above network traffic sample data, three edges can be obtained as follows:

[0040] Edge 1: Node 1->Node 2, features: [1500, TCP].

[0041] Edge 2: Node 3->Node 4, feature: [500, UDP].

[0042] Edge 3: Node 1->Node 3, feature: [2000, TCP].

[0043] The adjacency matrix A is used to characterize the communication status between any two nodes, and is represented by 0-1. For example, for nodes i and j, if there is communication between nodes i and j, then A ij =1, otherwise A ij = 0. The adjacency matrix can be a symmetric matrix. When the communication is bidirectional, A ij =A ji Therefore, for the network traffic sample data in the above example, its adjacency matrix can be shown in Table 2 below.

[0044] Table 2

[0045] 192.168.1.1 192.168.1.2 192.168.1.3 192.168.1.4 192.168.1.1 0 1 1 0 192.168.1.2 1 0 0 0 192.168.1.3 1 0 0 1 192.168.1.4 0 0 1 0

[0046] Among them, A 12 =1 means there is communication between node 1 and node 2, A 34 =1 indicates that there is communication between node 3 and node 4.

[0047] The node feature matrix X contains the traffic statistical features of each node, each row in the matrix represents a node, and each column represents the features of the node. For the network traffic sample data in the above example, its node feature matrix can be shown in Table 3 below.

[0048] Table 3

[0049]

[0050] The edge feature matrix E includes the communication features of each edge. Each row in the matrix represents an edge, which contains the communication information between two nodes. For the network traffic sample data in the above example, its edge feature matrix can be expressed in the form of [source node destination node data packet size protocol type] as follows: [192.16 8.1.1 192.168.1.2 1500 TCP], [192.168.1.3 192.168.1.4 500 UDP], [192.168.1.1 192.168.1.3 2000 TCP].

[0051] As the time window goes by, the features of the nodes and edges are continuously updated in each time segment, including the number of packets sent / received by the node, the total traffic size, the protocol type and other information, which will change according to the actual traffic data in the network. In practical applications, the node feature matrix, edge feature matrix and adjacency matrix can be updated to ensure that the latest features of network traffic data are captured in different time segments.

[0052] In terms of neural networks, graph convolutional networks (GCNs) are a basic form of graph neural networks, which are used to extract node features from graph structures. Graph convolutional networks aggregate the features of each node and its neighboring nodes, generate high-order feature representations of nodes layer by layer, and capture local topological information in the graph. The graph convolution layer is the core of the GNN model, which aggregates the feature information of nodes and their neighboring nodes through graph convolution. For each node v, the feature representation of the next layer It is generated by the feature aggregation of the node and its neighboring nodes. The specific calculation formula is as follows:

[0053]

[0054] in, is the feature representation of node v at the k+1th layer, is the set of neighbor nodes of node v, d (u) is the degree of neighbor node u, d (v) is the degree of node v, W (k) is the weight matrix of the graph convolution layer, σ is the activation function, is the feature representation of neighbor node u at the k+1th layer. In the graph convolution operation of this application, the node features come not only from the node itself, but also from the features of its neighbor nodes, and the feature representation of the current node is updated by aggregating the features of the neighbor nodes.

[0055] In order to improve the attention to important nodes in the graph, this application introduces a graph attention layer (GAT) based on the graph convolutional network. The graph attention layer can more accurately aggregate node information with important characteristics by assigning different attention weights to the neighboring nodes of each node, thereby improving the performance of the model. In the graph attention network, the attention weight between node v and its neighbor node u is calculated by the following formula:

[0056]

[0057] Among them, α vu is the attention weight between node v and its neighbor node u, a is a trainable attention parameter vector, and W is a trainable feature transformation matrix. v ||Wh u ] is the feature concatenation of node v and its neighbor node u, and LeakyReLU is the activation function used to calculate nonlinear transformations. The calculated attention weight α vu It will be used to perform weighted summation of neighbor node features to finally obtain a new node representation. This process helps the model better capture complex communication behaviors by emphasizing important neighbor node information.

[0058] When the graph convolutional network is combined with the graph attention layer, the feature update formula is as follows:

[0059]

[0060] Among them, W (k) It is the trainable weight matrix of GCN. Through such a combination, it is possible to selectively aggregate the information of important neighbor nodes in the graph convolution operation, thereby achieving more accurate network intrusion detection.

[0061] Based on the above content, the graph convolution block composed of multiple graph convolution layers and a graph attention layer arranged in sequence in this application is a multi-layer structure, such as Figure 3As shown in the figure, each layer updates the node features and finally outputs the classification result of each node. Specifically, for the received feature input, several layers of graph convolution layers (5 layers) generate high-order representations of each node by aggregating the features of neighboring nodes, and the output of each graph convolution layer is used as the input of the next layer; the attention mechanism is applied to the high-order features extracted by the graph convolution layer, and the weighted representation of the importance of each node is generated by weighted aggregation of the features of neighboring nodes; then the output layer maps the final node features to the classification results through a fully connected network, and determines the classification probability of each node, which is used to distinguish normal traffic from attack traffic.

[0062] As mentioned in the previous article, network traffic not only has static characteristics, but also has time dependence. In order to capture changes in the time dimension, this application combines time-dependent modeling technology on the basis of graph convolutional networks and graph attention layers to process graph structures of multiple time windows. Specifically, this application introduces a pre-trained Bi-LSTM layer to capture the correlation between time windows, and then applies the graph convolutional network and graph attention layer in turn to perform graph convolution and attention aggregation in the time dimension. Through convolution operations across time segments, the preset graph neural network can learn the changes between node features and neighbor nodes in different time windows, and identify continuous or intermittent intrusion behaviors. Through multi-layer dynamic graph convolution, the preset graph neural network can capture the time-dependent characteristics of network traffic and detect continuous attack patterns.

[0063] Based on the above, in another exemplary embodiment of the present application, the preset graph neural network includes an input layer, a Bi-LSTM layer, a plurality of graph convolution blocks and an output layer, such as Figure 2 As shown; the input end of the input layer is used to receive the training sample set; the output end of the input layer is connected to the input end of the Bi-LSTM layer; the output end of the Bi-LSTM layer is respectively connected to the input end of all the graph convolution blocks; the output end of the graph convolution block is connected to the input end of the output layer; the output end of the output layer is used to output the traffic type of each node. Figure 3 As shown, each of the graph convolution blocks includes a plurality of graph convolution layers and a graph attention layer arranged in sequence, and each of the graph convolution layers includes a graph convolution network and a ReLU activation network arranged in sequence.

[0064] In a practical application, the number of graph convolutional layers is 5. When ReLU is used to activate the network, in order to enhance the nonlinear ability of the model, the ReLU activation function is as follows:

[0065] σ(x)=max(0,x).

[0066] After constructing the training sample set and the preset graph neural network, the following steps are used for training:

[0067] (301) Divide the training sample set into a training subset, a validation subset and a test subset; for example, the division ratio is set to 70% for the training subset, 15% for the validation subset, and 15% for the test subset.

[0068] (302) The training subset is input into the preset graph neural network for training, and during the training process, the current loss value is calculated using the cross entropy loss function according to the predicted output and the true label; the true label is the traffic type of all nodes marked. Specifically, the graph structure sample and the corresponding node set, edge set, adjacency matrix, node feature matrix and edge feature matrix are input into the preset graph neural network in a unified format, with the goal of minimizing the classification error, and the cross entropy loss function is used to measure the classification performance of the network, so as to learn how to distinguish normal traffic from attack traffic. The cross entropy loss function is:

[0069]

[0070] in, is the current loss value, N is the number of samples in the training subset, and y i is the true label of the i-th training sample, is the predicted output of the ith training sample.

[0071] (303) Based on the current loss value, the parameters of the preset graph neural network are optimized by the back propagation algorithm until the preset number of iterative trainings are completed, and the initial network node traffic type recognition model is obtained; specifically, in each training iteration, the training subset is input into the preset graph neural network, the features of the nodes and edges are first extracted through the graph convolution layer, and then the features of the neighboring nodes are weighted and aggregated through the graph attention layer, and finally classified in the output layer to output the predicted label (normal traffic or attack traffic) of each node. Then, according to the predicted output and the true label, the current loss value is calculated using the cross entropy loss function. The larger the loss value, the greater the difference between the predicted result and the true label, and the parameters of the model need to be updated through back propagation. Finally, the gradient of the loss value to the model parameters is calculated through the back propagation algorithm, and Adam can be used to update the weights of the model during the training process.

[0072] In a practical application, the application performs 30 epochs of iterations, and each iteration runs a complete forward propagation and backpropagation on the training subset.

[0073] (304) Using the verification subset, adjust the parameters in the initial network node traffic type identification model to obtain a final network node traffic type identification model.

[0074] (305) Using the test subset to perform performance evaluation on the network node traffic type identification model.

[0075] In another application example, in order to prevent the model from overfitting, this application also uses L2 regularization technology and Dropout technology during the training process. During the training process of each layer, a part of the nodes are randomly discarded to ensure the generalization ability of the model.

[0076] The training sample set constructed in this application includes multiple continuous network traffic sample data. Therefore, the preset graph neural network is trained based on the training sample set, and the characteristics in the time dimension are considered. That is, this application realizes the training and optimization of the preset graph neural network based on the dynamic graph, so that the network node traffic type recognition model can process real-time network traffic data and classify the traffic type of the node in different time segments. For each node in the time window, the network node traffic type recognition model outputs its classification result (normal or attack), and can also detect continuous attack behavior, and can continuously monitor and process real-time network traffic data to generate classification results for intrusion detection.

[0077] In the application of graph neural network, such as Figure 4 As shown, the present application provides an intrusion detection method based on a graph neural network, which is executed by a computer device, and can be executed by a computer device such as a terminal or a server alone, or by a terminal and a server together. In the embodiment of the present application, the method is applied to Figure 1 The server 104 in the example is used for explanation, and the steps include the following steps 401 to 403.

[0078] Step 401, obtain the network traffic data in the current time window; wherein the network traffic data in the current time window overlaps with the network traffic data in the previous time window. Specifically, using the sliding window mechanism, the network traffic data of the latest period of time is used as the network traffic data of the current time window, and the data obtained in this step needs to undergo a preprocessing operation consistent with the above step (202) to ensure the quality and format of the data. In addition, the network traffic data in each time window overlaps, so that the network node traffic type identification model in the subsequent steps can continue to track changes in the time series. The selection of window size and sliding step size will directly affect the time granularity of detection and the response speed of the model.

[0079] Step 402, construct a graph structure based on the network traffic data in the current time window; the graph structure includes a node set, an edge set, a node feature matrix, an edge feature matrix and an adjacency matrix; the nodes in the node set are used to represent network entities, the edges in the edge set are used to represent the communication behavior between nodes, and the adjacency matrix is ​​used to represent the communication status between nodes. If a graph structure has been constructed, the node set, edge set, node feature matrix, edge feature matrix and adjacency matrix can be dynamically updated based on the new nodes obtained and the corresponding communication activities occurring in the network, thereby realizing the update of the graph structure.

[0080] Step 403, input the graph structure corresponding to the current time window into the network node traffic type recognition model to obtain the traffic type of each of the nodes; wherein the traffic type is normal traffic or attack traffic; the network node traffic type recognition model is obtained by training a preset graph neural network with a training sample set; in the preset graph neural network, for the input graph structure, the Bi-LSTM layer is used to extract the time feature information, and then the graph convolution layer and the graph attention mechanism are combined to extract the spatial feature information in the time dimension to obtain the traffic type of each node, and finally the classification result of each node in the current time window is output as normal traffic or attack traffic.

[0081] In summary, this application collects network traffic data from the network, including basic information such as IP, port number, protocol type, etc., and preprocesses the network traffic data to ensure the integrity and accuracy of the data. Then the preprocessed network traffic data is converted into a graph structure; a preset graph neural network is constructed, which consists of a multi-layer graph convolution or graph attention mechanism, and the high-order representation of each node in the graph is learned by aggregating the features of the node and its neighbor nodes; the preset graph neural network training adopts a supervised learning method, uses labeled normal traffic and attack traffic data for training, and optimizes the model parameters through the back propagation algorithm to ensure that the model can accurately distinguish between normal and abnormal traffic. In order to cope with the dynamic changes of network traffic, a dynamic graph mechanism is introduced to construct a graph structure corresponding to multiple time segments that change over time, and the characteristics of the network traffic topology structure that changes over time are captured through the time series analysis method, so as to enhance the model's ability to cope with continuous or sudden attacks. Finally, the trained network node traffic type recognition model can process network traffic data in real time, realize intrusion detection, and classify and judge abnormal traffic, identifying whether it is attack traffic and the specific attack type.

[0082] Compared with the existing technology, the present application also has the following advantages: Since graph neural networks can perform operations directly on network graphs, the present application exhibits high computing efficiency in the processing of large-scale network traffic, can cope with the ever-increasing amount of data and traffic complexity in modern networks, and is suitable for large-scale, real-time intrusion detection scenarios.

[0083] In an exemplary embodiment, a computer device is provided. The computer device may be a server or a terminal. The internal structure diagram thereof may be as follows: Figure 5 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an intrusion detection method based on a graph neural network is implemented.

[0084] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components. In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0085] In an exemplary embodiment, a computer-readable storage medium is provided, storing a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0086] In an exemplary embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0087] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0088] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM may be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0089] The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. The non-relational database may include a distributed database based on blockchain, etc., but is not limited thereto. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but is not limited thereto.

[0090] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0091] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. An intrusion detection method based on graph neural network, characterized in that: The intrusion detection method based on graph neural network includes: Acquire network traffic data in a current time window; wherein the network traffic data in the current time window overlaps with the network traffic data in a previous time window; According to the network traffic data in the current time window, a graph structure is constructed; the graph structure includes a node set, an edge set, a node feature matrix, an edge feature matrix and an adjacency matrix; the nodes in the node set are used to represent network entities, the edges in the edge set are used to represent communication behaviors between nodes, and the adjacency matrix is ​​used to represent communication states between nodes; The graph structure corresponding to the current time window is input into the network node traffic type recognition model to obtain the traffic type of each node; wherein the traffic type is normal traffic or attack traffic; the network node traffic type recognition model is obtained by training a preset graph neural network with a training sample set; in the preset graph neural network, for the input graph structure, the Bi-LSTM layer is used to extract time feature information, and then the graph convolution layer and the graph attention mechanism are combined to extract the spatial feature information in the time dimension to obtain the traffic type of each node.

2. The intrusion detection method based on graph neural network according to claim 1 is characterized in that: The process of constructing the training sample set includes: Based on the sliding window, the historical network traffic data within a preset time period is divided into multiple continuous network traffic sample data; there is overlap between two adjacent network traffic sample data; Performing data cleaning on a plurality of continuous network traffic sample data respectively, so that each of the network traffic sample data includes a source IP address, a destination IP address, a source port number, a destination port number, a transmission protocol type, and a data packet size; Label each cleaned network traffic sample data to obtain the corresponding traffic type of all nodes; The network traffic sample data after each data cleaning is subjected to feature extraction and format unification to obtain the corresponding node set, edge set, node feature matrix, edge feature matrix and adjacency matrix, and constitute a graph structure sample; one graph structure sample and the corresponding traffic types of all nodes constitute a training sample, and multiple training samples constitute a training sample set.

3. The intrusion detection method based on graph neural network according to claim 2 is characterized in that: The node in the node set is any one of a source IP address, a destination IP address, a source port number, and a destination port number; the node feature matrix includes traffic statistics characteristics of each node, and the traffic statistics characteristics include the number of sent data packets, the number of received data packets, the total amount of transmitted data, and the protocol distribution ratio; The edge feature matrix includes the communication features of each edge, and the communication features include data packet size, protocol type and transmission direction; the communication state between any two nodes in the adjacency matrix is ​​represented by 0-1.

4. The intrusion detection method based on graph neural network according to claim 1 is characterized in that: The preset graph neural network includes an input layer, a Bi-LSTM layer, a plurality of graph convolution blocks and an output layer; The input end of the input layer is used to receive the training sample set; the output end of the input layer is connected to the input end of the Bi-LSTM layer; The output end of the Bi-LSTM layer is respectively connected to the input ends of all the graph convolution blocks; the output ends of the graph convolution blocks are all connected to the input ends of the output layer; the output end of the output layer is used to output the traffic type of each node; Each of the graph convolution blocks includes a plurality of graph convolution layers and a graph attention layer arranged in sequence.

5. The intrusion detection method based on graph neural network according to claim 4 is characterized in that: Each of the graph convolutional layers includes a graph convolutional network and a ReLU activation network arranged in sequence; the number of the graph convolutional layers is 5.

6. The intrusion detection method based on graph neural network according to claim 2 is characterized in that: The process of training the preset graph neural network using the training sample set includes: Dividing the training sample set into a training subset, a validation subset and a test subset; The training subset is input into a preset graph neural network for training, and during the training process, a cross entropy loss function is used to calculate the current loss value according to the predicted output and the true label; the true label is the traffic type of all nodes marked; Based on the current loss value, the parameters of the preset graph neural network are optimized by a back propagation algorithm until a preset number of iterative trainings are completed to obtain an initial network node traffic type recognition model; Using the verification subset to adjust parameters in the initial network node traffic type identification model to obtain a final network node traffic type identification model; The test subset is used to perform performance evaluation on the network node traffic type identification model.

7. The intrusion detection method based on graph neural network according to claim 6 is characterized in that: The cross entropy loss function is: in, is the current loss value, N is the number of samples in the training subset, and y i is the true label of the i-th training sample, is the predicted output of the ith training sample.

8. The intrusion detection method based on graph neural network according to claim 6 is characterized in that: During the training process, L2 regularization and Dropout techniques are also used.

9. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the graph neural network-based intrusion detection method described in any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the intrusion detection method based on graph neural network described in any one of claims 1 to 8 is implemented.

Images