Encrypted malicious traffic detection method based on multi-scale space-time interaction graph network

Abstract

The invention discloses an encrypted malicious traffic detection method based on a multi-scale space-time interaction graph network, and the method comprises the steps: constructing an intra-flow traffic interaction graph network based on the interaction relation of data packets between a client and a server in a flow; constructing an intra-stream flow interaction graph feature extractor, and obtaining local feature information of the stream; constructing an inter-flow space-time diagram; constructing an inter-stream space-time diagram feature extractor, and obtaining space-time feature information of the streams; obtaining multi-scale fusion features according to a multi-scale feature fusion module; obtaining a normal flow depth single classification model; obtaining a malicious traffic depth single classification model; acquiring to-be-measured traffic data, and respectively inputting the normal traffic depth single classification model and the malicious traffic depth single classification model to obtain classification results; and detecting the traffic category based on the classification result. According to the invention, the malicious traffic identification accuracy is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to an encrypted malicious traffic detection method based on a multi-scale spatiotemporal interactive graph network. Background Art

[0002] In the field of network security, encrypted malicious traffic detection aims to identify and block malicious access behaviors in the network, thereby protecting computer networks and their resources from illegal attacks. However, at present, network traffic usually uses encryption protocols such as SSL / TLS to encrypt traffic, preventing users from directly accessing traffic data packets, resulting in the inability of traditional traffic detection methods to effectively identify encrypted malicious traffic.

[0003] Traditional traffic detection methods usually use machine learning methods, which mainly include: anomaly detection methods, classification detection methods and hybrid detection methods. The anomaly detection method uses a large number of normal network access traffic features to build a normal traffic detection model. For traffic that deviates from the normal traffic cluster center and exceeds the model set threshold, it is judged as abnormal traffic (or malicious traffic). Qin et al. used network traffic features such as target address, target port, source address, packet size and traffic duration entropy to build a traffic detection model based on the K-means algorithm, which can effectively detect DDoS attack traffic. Zolotukhin et al. used the DBSCAN (Density-Based Spatial Clustering of Applications with Noise) algorithm to build a normal traffic detection model. If the target traffic exceeds the detection model threshold, it is judged as DDoS attack traffic. In summary, the anomaly detection method based on the clustering algorithm can not only update the detection model online, but also enhance the ability to detect unknown traffic. However, if the attacker imitates the normal user network access behavior, the above method may have the problem of clustering attack-related traffic into normal traffic types.

[0004] Since abnormal network traffic also has significant characteristic information, malicious traffic detection can be regarded as a traffic classification problem. A network traffic classifier is constructed based on normal traffic and abnormal traffic, and then the classifier is used to identify whether the target traffic is abnormal traffic. Ajaeiya et al. proposed to use the statistical data of network traffic as a feature description to construct a traffic classification model based on the Baggedtrees algorithm. Xu et al. used information entropy, packet size, packet frequency and connection time to describe the characteristics of attack traffic, constructed a traffic classification model based on the random forest algorithm, and used it to detect whether the network node is under malicious traffic network attack. However, the training of classification-based detection methods is highly dependent on traffic feature description, but the feature description of malicious traffic will change with the development of encryption technology, making it difficult for this method to accurately identify unknown types of network traffic.

[0005] The hybrid detection method takes advantage of the technical advantages of the above two detection methods and effectively improves the performance of network anomaly detection. The method is usually divided into two steps. The first step is classification-based detection, and the second step is anomaly-based detection. Traffic samples classified as "normal" in the first step will be further processed in the second step and re-evaluated using anomaly or outlier detection algorithms to identify potential abnormal behaviors. IoTArgos detects suspicious behaviors by extracting 11 key features, including the number of packets every 5 minutes, and combining supervised learning and unsupervised learning algorithms. Supervised machine learning algorithms are used to filter attack traffic subsets, while unsupervised machine learning algorithms are used to identify samples that were misclassified as "normal" in the previous stage. Compared with single anomaly detection or classification detection methods, the hybrid detection method not only performs well in the classification accuracy of known attacks, but can also effectively detect unknown attack behaviors.

[0006] Deep learning methods are widely used in encrypted malicious traffic detection due to their powerful feature extraction capabilities. They can directly extract features from raw traffic. Zeng et al. proposed an end-to-end anomaly detection framework based on deep learning. Compared with traditional machine learning methods, deep learning algorithms require less manual intervention. Multi-layer neural networks can combine shallow features to form complex and abstract features, which are suitable for detecting hidden attack behaviors. Zolotukhin et al. combined clustering algorithms with SAE (Stack Auto Encoder) algorithms to build a DDoS attack detection model. Eight features, such as the percentage of packets with different TCP flags, were extracted in each time interval as inputs to the clustering and SAE models. The clustering algorithm is used to build a normal user behavior model and mark the behavior that deviates from this model as a DDoS attack; SAE is used to detect attacks that imitate normal user browsing behaviors, which are usually not effectively identified by clustering algorithms.

[0007] Knowledge-based methods use predefined rules to determine whether network traffic is malicious traffic. These rules are usually based on ports, protocol headers, and manually extracted features. David and Thomas proposed a fingerprint method that uses fast entropy to calculate the traffic count for each connection. However, the method's reliance on traffic counts limits its accuracy in distinguishing DDoS attacks. Summary of the invention

[0008] To solve the above technical problems, the present invention proposes an encrypted malicious traffic detection method based on a multi-scale spatiotemporal interactive graph network, which stores and predicts traffic data in the form of a graph, extracts traffic features through a multi-scale feature fusion module, and uses the Deep SVDD single classification objective function to train two single classification models of normal traffic and malicious traffic respectively, and uses the two models to jointly predict the traffic type, thereby improving the accuracy of malicious traffic identification.

[0009] To achieve the above object, the present invention provides an encrypted malicious traffic detection method based on a multi-scale spatiotemporal interactive graph network, comprising:

[0010] Acquire traffic source data, and process based on the traffic source data to obtain a flow;

[0011] Based on the interactive relationship of data packets between the client and the server in the flow, an intra-flow traffic interaction graph network is constructed; based on the intra-flow traffic interaction graph network, an intra-flow traffic interaction graph feature extractor is constructed to obtain local feature information of the flow;

[0012] Based on the temporal and spatial relationship between the flows, a spatiotemporal graph between flows is constructed; based on the spatiotemporal graph between flows, a spatiotemporal graph feature extractor between flows is constructed to obtain spatiotemporal feature information of the flows;

[0013] Extracting different scale features based on the local feature information of the flow and the spatiotemporal feature information of the flow, and obtaining multi-scale fusion features according to a multi-scale feature fusion module;

[0014] Normal traffic is used as positive samples and malicious traffic is used as negative samples. Based on the multi-scale fusion features, the normal traffic dataset and the malicious traffic dataset are combined to train the Deep SVDD single classification objective function to obtain a normal traffic deep single classification model.

[0015] Normal traffic is used as negative samples and malicious traffic is used as positive samples. Based on the multi-scale fusion features, the normal traffic dataset and the malicious traffic dataset are combined to train the Deep SVDD single classification objective function to obtain a malicious traffic deep single classification model.

[0016] The flow data to be tested is obtained, and the data is respectively input into the normal flow deep single classification model and the malicious flow deep single classification model to obtain classification results; and the flow category is detected based on the classification results.

[0017] Optionally, constructing an intra-flow traffic interaction graph network includes:

[0018] An intra-flow interaction graph is constructed for each flow, in which the packets in the flow are used as nodes, and edges are established between consecutive packets in the same sequence of consecutive packets transmitted in the same direction, and the first and last packets in two sequences of consecutive packets transmitted in the same direction are connected respectively.

[0019] Optionally, constructing the inter-flow spatiotemporal graph includes:

[0020] Each flow is taken as a node, and edges are established between the current flow and the first k flows closest to its start time, and between other flows with the same source IP address or target IP address. Five different types of edges are constructed based on the IP address, namely, the source IP address and the target IP address are the same, only the source IP address is the same, only the target IP address is the same, the source IP address is the same as the target IP address of another flow, and the target IP address is the same as the source IP address of another flow. Among them, the first three types are bidirectional edges, and the last two types are unidirectional edges.

[0021] Optionally, constructing an in-flow traffic interaction graph feature extractor includes:

[0022] The in-flow traffic interaction graph feature extractor consists of an embedding layer, a position encoding layer, a three-layer GAT and a global attention pooling layer;

[0023] The first layer is the embedding layer, which is used to convert the packet size into a vector representation through the embedding matrix;

[0024] Through the position encoding layer, relative and absolute position encoding are added to obtain position information;

[0025] The second, third, and fourth layers use GAT to perform graph convolution operations, and extract graph features through the global attention mechanism after each convolution layer;

[0026] The features obtained from each layer of convolution are concatenated to fuse feature information at different levels;

[0027] The fifth layer obtains the local feature information of the flow through global attention pooling.

[0028] Optionally, constructing an inter-stream spatiotemporal graph feature extractor includes:

[0029] The inter-stream spatiotemporal graph feature extractor consists of a position encoding layer, a three-layer RGAT, and a global attention pooling layer;

[0030] Use the local feature information of the flow as the initial node feature in the spatiotemporal graph, and obtain the position information by combining relative and absolute position encoding through the position encoding layer;

[0031] The second, third, and fourth layers use RGAT to perform relational attention convolution on five different types of edges to obtain the spatiotemporal feature information of the flow nodes;

[0032] The fifth layer obtains the spatiotemporal feature information of the flow through the global attention pooling layer.

[0033] Optionally, obtaining a multi-scale fusion feature according to a multi-scale feature fusion module includes:

[0034] The multi-scale feature fusion module consists of a bilinear transformation layer and a weighted fusion module:

[0035] splicing the stream local features and the stream spatiotemporal features respectively extracted based on the local feature information of the stream and the spatiotemporal feature information of the stream, and calculating the weights through a bilinear transformation layer;

[0036] Based on the weighted fusion module, the flow local features and the flow spatiotemporal features are fused by weight to obtain multi-scale fusion features.

[0037] Optionally, based on the multi-scale fusion feature combined with the normal traffic data set and the malicious traffic data set, training a single classification objective function based on Deep SVDD includes:

[0038] Based on the soft-boundary objective function, the minimum enclosing hypersphere is iteratively optimized and the stream local feature extractor and stream spatiotemporal feature extractor are feedback optimized to obtain the optimal Deep SVDD single classification model.

[0039] Optionally, detecting the traffic category based on the classification result includes:

[0040] If the classification result of the malicious traffic single classification model is positive, it is judged as malicious traffic;

[0041] If the classification result of the normal traffic single classification model is positive, and the classification result of the malicious traffic single classification model is negative, then it is judged as normal traffic;

[0042] If the classification results of the two models are both negative, it is judged as unknown traffic.

[0043] Technical effect of the present invention: The present invention discloses an encrypted malicious traffic detection method based on a multi-scale spatiotemporal interaction graph network, which obtains traffic source data, delineates flows with a five-tuple rule, extracts data packet size, direction and capture time information in units of flows, and constructs a traffic detection data set; constructs an intra-flow interaction graph to extract flow local features and an inter-flow spatiotemporal graph to extract flow global features, and uses the fusion features obtained by a multi-scale feature fusion module to train a normal traffic classification model and a malicious traffic classification model based on Deep SVDD; the traffic to be tested is respectively input into two trained classification models, and the classification results of the two models are combined to jointly predict the category of the traffic to be tested, thereby improving the accuracy of malicious traffic identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0045] Figure 1 A schematic diagram of a flow chart of an encrypted malicious traffic detection method based on a multi-scale spatiotemporal interactive graph network according to an embodiment of the present invention;

[0046] Figure 2 is a schematic diagram of an intra-stream interaction graph in an embodiment of the present invention;

[0047] Figure 3 A schematic diagram of a multi-scale encrypted malicious traffic feature extractor in an embodiment of the present invention;

[0048] Figure 4 Schematic diagram of a malicious traffic single classification model and a normal traffic single classification model based on Deep SVDD in an embodiment of the present invention. DETAILED DESCRIPTION

[0049] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0050] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0051] like Figure 1 As shown, this embodiment provides an encrypted malicious traffic detection method based on a multi-scale spatiotemporal interactive graph network, including:

[0052] Obtain traffic source data, process based on the traffic source data, and obtain flow;

[0053] Based on the interactive relationship between the data packets between the client and the server in the flow, an intra-flow traffic interaction graph network is constructed; based on the intra-flow traffic interaction graph network, an intra-flow traffic interaction graph feature extractor is constructed to obtain local feature information of the flow;

[0054] Based on the temporal and spatial relationship between flows, a spatiotemporal graph between flows is constructed; based on the spatiotemporal graph between flows, a spatiotemporal graph feature extractor between flows is constructed to obtain spatiotemporal feature information of flows;

[0055] Different scale features are extracted based on the local feature information and spatiotemporal feature information of the flow, and multi-scale fusion features are obtained according to the multi-scale feature fusion module;

[0056] Normal traffic is used as positive samples and malicious traffic is used as negative samples. Based on the multi-scale fusion features, the normal traffic dataset and the malicious traffic dataset are combined to train the Deep SVDD single classification objective function to obtain a normal traffic deep single classification model.

[0057] Normal traffic is used as negative samples and malicious traffic is used as positive samples. Based on the multi-scale fusion features, the normal traffic dataset and the malicious traffic dataset are combined to train the Deep SVDD single classification objective function to obtain a deep single classification model for malicious traffic.

[0058] Obtain the traffic data to be tested, input the data into a normal traffic deep single classification model and a malicious traffic deep single classification model respectively, and obtain classification results; detect the traffic category based on the classification results.

[0059] Specifically, in this embodiment, a traffic data set is first obtained, an intra-flow traffic interaction network is constructed, an intra-flow interaction graph feature extractor is constructed, and local feature information of the flow is obtained; an inter-flow spatiotemporal graph is constructed, and an inter-flow spatiotemporal graph feature extractor is constructed to obtain spatiotemporal feature information of the flow; multi-scale fusion features are obtained based on a feature fusion module; normal traffic is input as a positive sample and malicious traffic is input as a negative sample, and training is performed based on a Deep SVDD single classification objective function to obtain a trained normal traffic deep single classification model; normal traffic is input as a negative sample and malicious traffic is input as a positive sample, and training is performed based on a Deep SVDD single classification objective function to obtain a trained malicious traffic deep single classification model; the traffic data to be tested is input into the trained model, and the classification results of the two models are used to jointly predict the traffic category, and finally the classification results of the traffic are output. This example proposes a method for detecting malicious traffic by combining a graph network to achieve accurate detection of malicious traffic in web page access.

[0060] Furthermore, traffic source data is obtained, and processing is performed based on the traffic source data to obtain flows including:

[0061] Construct traffic source data, obtain network traffic data packets, divide traffic data packets using the five-tuple (source IP address, source IP address port, destination IP address, destination IP address port, protocol) rule, define data packets with the same five-tuple as a flow, extract data packet size, direction, capture time and other information in units of flow, and construct traffic detection data sets, including normal traffic data sets and malicious traffic data sets;

[0062] Further, such as Figure 2 The network for constructing the intra-flow traffic interaction graph shown includes:

[0063] All data packets are divided into traffic packets using the five-tuple (source IP address, source IP address port, destination IP address, destination IP address port, protocol) rule. Packets with the same five-tuple are defined as a flow. An intra-flow interaction graph is constructed for each flow, in which the data packets in the flow are used as nodes. Edge connections are established between consecutive data packets in the same sequence of consecutive data packets transmitted in the same direction, and the first and last data packets in two sequences of consecutive data packets transmitted in the same direction are connected respectively.

[0064] Furthermore, constructing the inter-flow spatiotemporal graph includes:

[0065] Each flow is taken as a node, and edges are established between the current flow and the first k flows closest to its start time, and between other flows with the same source IP address or target IP address. Five different types of edges are constructed based on the IP address, namely, the source IP address and the target IP address are the same, only the source IP address is the same, only the target IP address is the same, the source IP address is the same as the target IP address of another flow, and the target IP address is the same as the source IP address of another flow. Among them, the first three types are bidirectional edges, and the last two types are unidirectional edges.

[0066] Specifically, in this embodiment, the data set is divided and the graph network is constructed. CICAndMal2017 is used as a data set, which contains 2126 samples in total, and each sample corresponds to an instance of an Android application installed and executed on a mobile phone. For each instance, all network traffic during its execution is captured. 100 samples of each type are sampled for encrypted malicious traffic classification training. 5% of the remaining samples are sampled in a stratified manner for sampling and verification, and the remaining samples are used for testing.

[0067] Further, such as Figure 3 The construction of the in-flow traffic interaction graph feature extractor shown includes:

[0068] Given a set of in-flow interaction graphs The local feature extractor aims to learn a vector representation F of the local features of the flow L .

[0069] The intra-flow flow interaction graph feature extractor consists of an embedding layer, a position encoding layer, a three-layer GAT, and a global attention pooling layer;

[0070] The first layer is the embedding layer, which is used to embed the data packet size X = [x1, x2, ..., x n ] through the embedding matrix E∈R V×d Convert to vector representation H = E[x], H∈R n×d ;

[0071] Where X = [x1, x2, ..., x n ] represents a sequence of packet sizes of length n in a stream, E∈R V×d H = E[x], H∈R represents the embedding matrix, which converts the input packet size into an embedding vector, V represents the number of different packet sizes in X, and d represents the dimension after embedding. n×d is X = [x1, x2, ..., x n ]The result after embedding.

[0072] Through the position encoding layer, relative and absolute position encoding are added to obtain position information:

[0073]

[0074] Among them, pos represents the relative position or absolute position of the data packet in the flow, i represents a dimension of the vector, and d model Indicates the size of the embedding dimension.

[0075] Use the order of packets in the stream as pos to get the relative position encoding, and use the time difference between each packet and the first packet in the stream as pos to get the absolute position encoding. Add the two position encodings together as the final position encoding. Combining relative and absolute position encoding can capture both the position order and actual time information in the sequence, allowing the model to better understand the position relationship between packets and better adapt to the actual time difference for packets with irregular time intervals.

[0076] The second, third, and fourth layers use GAT to perform graph convolution operations, and extract graph features through the global attention mechanism after each convolution layer;

[0077] The features obtained from each layer of convolution are concatenated to fuse feature information at different levels:

[0078]

[0079] Where l represents the current number of GAT layers, is the attention score between node i and node j in the kth attention head, W krepresents the learnable weight matrix of the kth attention head, N i Represents the neighbors of node i:

[0080]

[0081]

[0082] F L =concat(F L1 , F L2 , F L3 ),

[0083] where f gate is a linear transformation used to calculate the attention weight of each node and normalize it through softmax, f feat It is a linear transformation used to transform the features of each node into a new feature representation;

[0084] The fifth layer obtains the local feature information of the flow through global attention pooling.

[0085] Furthermore, constructing an inter-stream spatiotemporal graph feature extractor includes:

[0086] Given a space-time graph G ST , the goal of the spatiotemporal feature extractor is to learn a vector representation F of the local features of the flow G .

[0087] The inter-stream spatiotemporal graph feature extractor consists of a position encoding layer, a three-layer RGAT, and a global attention pooling layer;

[0088] Use the local feature information of the flow as the initial node feature in the spatiotemporal graph, and obtain the position information by combining relative and absolute position encoding through the position encoding layer:

[0089]

[0090] Where pos represents the relative position or absolute position of the flow, i represents a dimension of the vector, and d model Indicates the size of the embedding dimension.

[0091] Specifically, the order of the flow in the captured traffic is used as pos to obtain the relative position code, and the time difference between each flow and the first flow is used as pos to obtain the absolute position code. The two position codes are added together as the final position code. Combining relative and absolute position codes can capture both the position order and the actual time information in the sequence, so that the model can better understand the position relationship between flows and better adapt to the actual time difference for flows with irregular time intervals.

[0092] The second, third, and fourth layers use RGAT to perform relational attention convolution on five different types of edges to obtain the spatiotemporal feature information of the flow nodes;

[0093] Use three layers of RGAT to extract the spatiotemporal features of flow nodes:

[0094]

[0095] in, is the vector obtained by calculating the attention of the ,th layer node, is the attention score between node i and node j in the k-th attention head of the ,th layer. is the vector calculated from the,th layer relational attention, is the attention score between node i and node j in the,th layer,relation m, is the learnable weight matrix of the relation m at the ,th layer. ij are the characteristics of different types of edges, W m1 , b m1 , W m2 , b m2 , is the weight matrix and bias term, for r ij Perform a linear transformation to calculate the attention score of relation m.

[0096] The fifth layer obtains the spatiotemporal feature information of the flow through the global attention pooling layer.

[0097] Furthermore, the multi-scale fusion features obtained according to the multi-scale feature fusion module include:

[0098] The multi-scale feature fusion module consists of a bilinear transformation layer and a weighted fusion module:

[0099] The local features of the stream and the spatiotemporal features of the stream extracted based on the local feature information of the stream and the spatiotemporal feature information of the stream are concatenated, and the weights are calculated through a bilinear transformation layer;

[0100] Based on the weighted fusion module, the flow local features and flow spatiotemporal features are fused by weight to obtain multi-scale fusion features.

[0101] Specifically, the feature fusion module calculates the weight λ based on the local features of the flow and the spatiotemporal features of the flow:

[0102] λ=bilinear(F L , F G , W),

[0103] Among them, F L is the local feature of the flow, F G is the flow spatiotemporal feature, W is the weight matrix in the bilinear layer, and the flow local feature F is fused through the weight λ L and flow spatiotemporal characteristics FG ,

[0104] F combined =(1-λ)·F L +λ·F G .

[0105] Furthermore, based on the multi-scale fusion features combined with the normal traffic dataset and the malicious traffic dataset, the training of the single classification objective function based on Deep SVDD includes:

[0106] Based on the soft-boundary objective function, the minimum enclosing hypersphere is iteratively optimized and the stream local feature extractor and stream spatiotemporal feature extractor are feedback optimized to obtain the optimal Deep SVDD single classification model.

[0107] Specifically, in this example, normal traffic is input as a positive sample and malicious traffic is input as a negative sample, and training is performed based on the DeepSVDD single classification objective function to obtain a trained normal traffic deep single classification model; normal traffic is input as a negative sample and malicious traffic is input as a positive sample, and training is performed based on the Deep SVDD single classification objective function to obtain a trained normal traffic deep single classification model, such as Figure 4 As shown:

[0108] Input Space:

[0109] Output Space:

[0110] Mapping neural network from X to F: There are L∈N hidden layers with weights W={W 1 , ..., W L},W l represents the weight of layer l∈[1,...,L]. The goal of Deep SVDD is to learn the network parameters to obtain the minimum volume enclosing circle with radius R and center c in the output space F.

[0111]

[0112] In the above formula, minimizing R 2 The minimization of the hypersphere can be achieved. The second term is used to penalize points outside the hypersphere, and the hyperparameter vn∈(0, 1] controls the volume of the sphere and the degree of relaxation of the boundary. The last term is the regularization loss of the training parameters.

[0113] Calculate the distance between the network output and the center point c on the training data. If it is less than the threshold R, it is considered to be a positive class, otherwise it is other categories:

[0114]

[0115] Furthermore, the traffic categories detected based on the classification results include:

[0116] If the classification result of the malicious traffic single classification model is positive, it is judged as malicious traffic;

[0117] If the classification result of the normal traffic single classification model is positive, and the classification result of the malicious traffic single classification model is negative, then it is judged as normal traffic;

[0118] If the classification results of the two models are both negative, it is judged as unknown traffic.

[0119] The present invention discloses an encrypted malicious traffic detection method based on a multi-scale spatiotemporal interaction graph network. The method obtains traffic source data, delineates flows with a five-tuple rule, extracts data packet size, direction and capture time information in units of flows, and constructs a traffic detection data set; constructs an intra-flow interaction graph to extract flow local features and an inter-flow spatiotemporal graph to extract flow global features, and uses fusion features obtained by a multi-scale feature fusion module to train a normal traffic classification model and a malicious traffic classification model based on Deep SVDD; the traffic to be tested is respectively input into two trained classification models, and the classification results of the two models are combined to jointly predict the category of the traffic to be tested, thereby improving the accuracy of malicious traffic identification.

[0120] The above are only preferred specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for detecting encrypted malicious traffic based on a multi-scale spatiotemporal interactive graph network, characterized in that: include: Acquire traffic source data, and process based on the traffic source data to obtain a flow; Based on the interactive relationship of data packets between the client and the server in the flow, an intra-flow traffic interaction graph network is constructed; based on the intra-flow traffic interaction graph network, an intra-flow traffic interaction graph feature extractor is constructed to obtain local feature information of the flow; Based on the temporal and spatial relationship between the flows, a spatiotemporal graph between flows is constructed; based on the spatiotemporal graph between flows, a spatiotemporal graph feature extractor between flows is constructed to obtain spatiotemporal feature information of the flows; Extracting different scale features based on the local feature information of the flow and the spatiotemporal feature information of the flow, and obtaining multi-scale fusion features according to a multi-scale feature fusion module; Normal traffic is used as positive samples and malicious traffic is used as negative samples. Based on the multi-scale fusion features, the normal traffic dataset and the malicious traffic dataset are combined to train the Deep SVDD single classification objective function to obtain a normal traffic deep single classification model. Normal traffic is used as negative samples and malicious traffic is used as positive samples. Based on the multi-scale fusion features, the normal traffic dataset and the malicious traffic dataset are combined to train the Deep SVDD single classification objective function to obtain a malicious traffic deep single classification model. Obtain the traffic data to be tested, and input the normal traffic deep single classification model and the malicious traffic deep single classification model respectively to obtain classification results; A traffic class is detected based on the classification result.

2. The encrypted malicious traffic detection method based on a multi-scale spatiotemporal interactive graph network as claimed in claim 1 is characterized in that: Constructing the intra-flow traffic interaction graph network includes: An intra-flow interaction graph is constructed for each flow, in which the packets in the flow are used as nodes, and edges are established between consecutive packets in the same sequence of consecutive packets transmitted in the same direction, and the first and last packets in two sequences of consecutive packets transmitted in the same direction are connected respectively.

3. The encrypted malicious traffic detection method based on a multi-scale spatiotemporal interactive graph network as claimed in claim 1 is characterized in that: Constructing the inter-flow spatiotemporal graph includes: Each flow is taken as a node, and edges are established between the current flow and the first k flows closest to its start time, and between other flows with the same source IP address or target IP address. Five different types of edges are constructed based on the IP address, namely, the source IP address and the target IP address are the same, only the source IP address is the same, only the target IP address is the same, the source IP address is the same as the target IP address of another flow, and the target IP address is the same as the source IP address of another flow. Among them, the first three types are bidirectional edges, and the last two types are unidirectional edges.

4. The encrypted malicious traffic detection method based on a multi-scale spatiotemporal interactive graph network as claimed in claim 1 is characterized in that: Constructing the in-flow traffic interaction graph feature extractor includes: The in-flow traffic interaction graph feature extractor consists of an embedding layer, a position encoding layer, a three-layer GAT and a global attention pooling layer; The first layer is the embedding layer, which is used to convert the packet size into a vector representation through the embedding matrix; Through the position encoding layer, relative and absolute position encoding are added to obtain position information; The second, third, and fourth layers use GAT to perform graph convolution operations, and extract graph features through the global attention mechanism after each convolution layer; The features obtained from each layer of convolution are concatenated to fuse feature information at different levels; The fifth layer obtains the local feature information of the flow through global attention pooling.

5. The encrypted malicious traffic detection method based on a multi-scale spatiotemporal interactive graph network as claimed in claim 1 is characterized in that: Building an inter-stream spatiotemporal graph feature extractor includes: The inter-stream spatiotemporal graph feature extractor consists of a position encoding layer, a three-layer RGAT, and a global attention pooling layer; Use the local feature information of the flow as the initial node feature in the spatiotemporal graph, and obtain the position information by combining relative and absolute position encoding through the position encoding layer; The second, third, and fourth layers use RGAT to perform relational attention convolution on five different types of edges to obtain the spatiotemporal feature information of the flow nodes; The fifth layer obtains the spatiotemporal feature information of the flow through the global attention pooling layer.

6. The encrypted malicious traffic detection method based on a multi-scale spatiotemporal interactive graph network as claimed in claim 1 is characterized in that: The multi-scale fusion features obtained according to the multi-scale feature fusion module include: The multi-scale feature fusion module consists of a bilinear transformation layer and a weighted fusion module: Based on the local feature information of the stream and the spatiotemporal feature information of the stream, respectively extracting the local features of the stream and the spatiotemporal features of the stream for splicing, and calculating the weights through a bilinear transformation layer; Based on the weighted fusion module, the flow local features and the flow spatiotemporal features are fused by weight to obtain multi-scale fusion features.

7. The encrypted malicious traffic detection method based on a multi-scale spatiotemporal interactive graph network as claimed in claim 1 is characterized in that: Based on the multi-scale fusion features combined with the normal traffic data set and the malicious traffic data set, the training of the DeepSVDD-based single classification objective function includes: Based on the soft-boundary objective function, the minimum enclosing hypersphere is iteratively optimized and the stream local feature extractor and stream spatiotemporal feature extractor are feedback optimized to obtain the optimal Deep SVDD single classification model.

8. The method for detecting encrypted malicious traffic based on a multi-scale spatiotemporal interactive graph network as claimed in claim 1, characterized in that: Detecting traffic categories based on the classification results includes: If the classification result of the malicious traffic single classification model is positive, it is judged as malicious traffic; If the classification result of the normal traffic single classification model is positive, and the classification result of the malicious traffic single classification model is negative, then it is judged as normal traffic; If the classification results of the two models are both negative, it is judged as unknown traffic.

Images