Network traffic detection method and device, equipment and storage medium

Abstract

The invention discloses a network traffic detection method and device, equipment and a storage medium. The method comprises the following steps: firstly, acquiring a real-time dynamic graph containing dynamic connection relationships of a plurality of network entities, a semantic graph reflecting semantic vector association of the entities, and to-be-detected network traffic data; a structured representation vector is then allocated to each network entity in the real-time dynamic graph, the vector representing a feature attribute of the entity. And for each network entity, fusing the structured representation vector of the network entity, the semantic vector in the corresponding semantic graph and the semantic vector of the adjacent network entity to form a fusion feature. And performing semantic analysis and pattern learning on the fused features by using a semantic understanding model to obtain a network behavior anomaly detection rule, and performing behavior judgment and anomaly detection on the to-be-detected network traffic data by applying the anomaly detection rule to obtain a detection result. According to the invention, the capability of identifying and tracking hidden malicious communication and novel attacks is obviously improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, apparatus, device and storage medium for detecting network traffic. Background Art

[0002] Current network security traffic analysis relies on heterogeneous graph analysis methods. However, the heterogeneous graphs provided by current technologies are mostly static network topologies composed primarily of fixed metadata (such as Internet Protocol (IP) addresses and ports). This heterogeneous graph architecture lacks semantic information hidden in encrypted traffic, such as Domain Name System (DNS) query intent and threat keywords in Hypertext Transfer Protocol (HTTP) headers. Therefore, heterogeneous graph analysis methods struggle to parse the semantic content of encrypted traffic, making it difficult to identify covert command and control (C&C) communications (C&C communications are the communication method used by malware (such as Trojans and botnets) to receive instructions from attackers) within Transport Layer Security (TLS) or Secure Sockets Layer (SSL) tunnels. This makes it difficult to respond to new attacks such as encrypted traffic deformation or zero-day vulnerabilities. In addition, the heterogeneous graphs provided by current technologies lack a unified semantic representation space, and are unable to cross the data barriers of different protocols and effectively associate abnormal behaviors in multi-protocol traffic, which limits the dynamic tracking capability of the attack chain and leads to inefficient identification and tracing of multi-protocol attack chains.

[0003] Therefore, how to improve the ability to identify and track covert malicious communications and new types of attacks is a technical problem that technical personnel in this field urgently need to solve. Summary of the Invention

[0004] Based on the above problems, the present application provides a network traffic detection method, device, equipment and storage medium, which can improve the ability to identify and track covert malicious communications and new attacks.

[0005] The embodiments of this application disclose the following technical solutions:

[0006] A method for detecting network traffic, the method comprising:

[0007] Acquire a real-time dynamic graph, a semantic graph, and network traffic data to be detected; the real-time dynamic graph includes dynamic connection relationships between multiple network entities; the semantic graph includes connection relationships between semantic vectors corresponding to each network entity in the real-time dynamic graph;

[0008] Configuring a structured representation vector for each network entity in the real-time dynamic graph; wherein the structured representation vectors of each network entity in the real-time dynamic graph have a topological dependency relationship;

[0009] For each network entity in the real-time dynamic graph, feature fusion is performed on the structured representation vector of the network entity, the semantic vector corresponding to the network entity in the semantic graph, and the adjacent semantic vectors of the network entity to obtain a fused feature; the adjacent semantic vectors of the network entity are: semantic vectors corresponding to network entities that have a connection relationship with the network entity in the real-time dynamic graph;

[0010] Using a semantic understanding model to perform semantic analysis and pattern learning on the fusion features to obtain network behavior anomaly detection rules;

[0011] The network behavior anomaly detection rules are used to perform behavior determination and anomaly detection on the network traffic data to be detected to obtain a detection result.

[0012] In a possible implementation, for each network entity in the real-time dynamic graph, performing feature fusion on a structured representation vector of the network entity, a semantic vector corresponding to the network entity in the semantic graph, and adjacent semantic vectors of the network entity to obtain a fused feature includes:

[0013] For each network entity in the real-time dynamic graph, the interaction between the structured representation vector of the network entity and the semantic vector corresponding to the network entity in the semantic graph is modeled and calculated using the graph attention network (GAT) to obtain the attention coefficient of the network entity;

[0014] For each network entity in the real-time dynamic graph, combined with the attention coefficient of the network entity, the semantic vector of the network entity and the adjacent semantic vectors of the network entity are weightedly summed through the GAT to obtain the fusion feature.

[0015] In one possible implementation, the training process of the semantic understanding model includes:

[0016] Configure a threat knowledge base for the large language model LMM;

[0017] Obtain a training data set; the training data set includes positive samples with malicious behavior labels and negative samples with normal behavior labels; the positive samples include abnormal network traffic data carrying network attack events; the negative samples include normal network traffic data;

[0018] Using the training data set as a model input and combining it with a loss function, the LMM configured with the threat knowledge base is trained to obtain the semantic understanding model with threat detection capability;

[0019] Wherein, the loss function is: L=L cls +λ·L contrast , L cls is the cross entropy loss, L contrast is the contrastive learning loss.

[0020] In a possible implementation, the process of constructing the real-time dynamic graph includes:

[0021] Obtain the interaction characteristics of each network entity in real-time network traffic data;

[0022] Constructing connection relationships between the network entities according to interaction characteristics of the network entities to obtain the real-time dynamic graph;

[0023] At intervals of a preset time period, the interaction characteristics of each network entity in the real-time network traffic are obtained again to obtain the latest interaction data, and the real-time dynamic graph is updated using the latest interaction data.

[0024] In one possible implementation, the process of constructing the semantic graph includes:

[0025] Acquire network protocol data of each network entity in the real-time network traffic data;

[0026] Performing semantic analysis on each network protocol data using the semantic understanding model to obtain a semantic vector of each network protocol data;

[0027] The connection relationship between the semantic vectors is constructed according to the correlation between the semantic vectors to obtain the semantic graph.

[0028] A network traffic detection device, comprising:

[0029] A first acquisition unit is configured to acquire a real-time dynamic graph, a semantic graph, and network traffic data to be detected; the real-time dynamic graph includes a dynamic connection relationship between multiple network entities; the semantic graph includes a connection relationship between semantic vectors corresponding to each network entity in the real-time dynamic graph;

[0030] A structured representation vector configuration unit is configured to configure a structured representation vector for each network entity in the real-time dynamic graph; the structured representation vectors of each network entity in the real-time dynamic graph have a topological dependency relationship;

[0031] a feature fusion unit configured to, for each network entity in the real-time dynamic graph, fuse the structured representation vector of the network entity, the semantic vector corresponding to the network entity in the semantic graph, and the adjacent semantic vectors of the network entity to obtain a fused feature; the adjacent semantic vectors of the network entity are semantic vectors corresponding to network entities that have a connection relationship with the network entity in the real-time dynamic graph;

[0032] A detection rule generation unit, configured to perform semantic analysis and pattern learning on the fusion features using a semantic understanding model to obtain a network behavior anomaly detection rule;

[0033] The detection unit is used to use the network behavior anomaly detection rules to perform behavior judgment and anomaly detection on the network traffic data to be detected to obtain a detection result.

[0034] In a possible implementation, the feature fusion unit specifically includes:

[0035] an attention coefficient calculation unit, configured to model and calculate, for each network entity in the real-time dynamic graph, the interaction between the structured representation vector of the network entity and the semantic vector corresponding to the network entity in the semantic graph through GAT, to obtain an attention coefficient of the network entity;

[0036] The fusion feature calculation unit is used to perform weighted summation of the semantic vector of the network entity and the adjacent semantic vectors of the network entity through the GAT for each network entity in the real-time dynamic graph, in combination with the attention coefficient of the network entity, to obtain the fusion feature.

[0037] In a possible implementation, the apparatus further includes:

[0038] A knowledge base configuration unit is used to configure a threat knowledge base for the large language model LMM;

[0039] A second acquisition unit is configured to acquire a training data set; the training data set includes positive samples with malicious behavior labels and negative samples with normal behavior labels; the positive samples include abnormal network traffic data carrying network attack events; and the negative samples include normal network traffic data;

[0040] A model training unit, configured to use the training data set as a model input and, in combination with a loss function, perform model training on the LMM configured with the threat knowledge base to obtain the semantic understanding model with threat detection capability;

[0041] The loss function is: L=Lcls+Lcontrast, Lcls is the cross entropy loss, and Lcontrast is the contrast learning loss.

[0042] A network traffic detection device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the network traffic detection method described above is implemented.

[0043] A computer-readable storage medium stores instructions, which, when executed on a terminal device, enable the terminal device to execute the network traffic detection method described above.

[0044] Compared with the existing technology, this application has the following beneficial effects:

[0045] The present application provides a method, apparatus, device and storage medium for detecting network traffic. Specifically, when executing the method for detecting network traffic provided in the embodiment of the present application, first, a real-time dynamic graph, a semantic graph and the network traffic data to be detected can be obtained, wherein the real-time dynamic graph dynamically reflects the constantly changing connection relationship between multiple network entities, can accurately capture the temporal characteristics of the network topology, and enhance the perception of dynamic changes in network behavior. At the same time, the semantic graph reveals the association relationship between the corresponding semantic vectors of each network entity in the real-time dynamic graph, which helps to deeply mine hidden semantic information and enhance the expression ability at the semantic level. Then, a structured representation vector is configured for each network entity in the real-time dynamic graph, and these vectors contain the basic attributes of the entity. Subsequently, for each network entity, its structured representation vector, the corresponding semantic vector in the semantic graph and the semantic vectors of its adjacent network entities are fused to form rich fusion features. This step not only captures the semantic features of a single entity by integrating multi-source information, but also combines the semantic context of its neighbors, greatly improving the integrity and accuracy of feature expression. Then, a semantic understanding model is used to conduct in-depth semantic analysis and pattern learning on the fused features, automatically generating network behavior anomaly detection rules. This makes the detection process more intelligent and precise, effectively identifying complex and hidden anomalous behaviors. Finally, based on the resulting detection rules, behavior determination and anomaly detection are performed on the network traffic data to be tested, and detection results are output, enabling timely discovery and response to network threats. By leveraging the dynamically changing network entity connection relationships (real-time dynamic graphs) and the corresponding semantic vector relationships (semantic graphs), this application can more accurately reflect the time-varying characteristics and deep semantic information of network traffic, breaking through the limitations of static topology structures. Simultaneously, by utilizing the connection relationships between semantic graphs and semantic vectors, combined with a semantic understanding model to analyze the fused features, it can effectively identify the semantic content in encrypted traffic, thereby identifying hidden malicious communications and new attacks. Furthermore, by fusing structured representation vectors and semantic vectors, and using the semantic understanding model for pattern learning, it can effectively correlate anomalous behaviors in multi-protocol traffic, improving the efficiency of identifying and tracing multi-protocol attack chains. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in this embodiment or the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0047] Figure 1 A flowchart of a method for detecting network traffic provided in an embodiment of the present application;

[0048] Figure 2 A flow chart of a method for vector feature fusion provided in an embodiment of the present application;

[0049] Figure 3 A flowchart of a method for training a semantic understanding model provided in an embodiment of the present application;

[0050] Figure 4 A flow chart of a method for constructing a real-time dynamic graph provided in an embodiment of the present application;

[0051] Figure 5 A flowchart of a method for constructing a semantic graph provided in an embodiment of the present application;

[0052] Figure 6 A schematic diagram of the structure of a network traffic detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] To facilitate understanding of the technical solutions provided by the embodiments of the present application, the background technology involved in the embodiments of the present application will be described below.

[0054] Current network security traffic analysis primarily relies on heterogeneous graph analysis methods. However, the heterogeneous graphs constructed using current technologies are mostly static network topologies composed primarily of fixed metadata (such as IP addresses and ports). This static heterogeneous graph architecture lacks the ability to understand the semantic information hidden in encrypted traffic (such as DNS query intent and threat keywords in HTTP headers), making it difficult to parse the semantic content of encrypted traffic. This makes it difficult to identify covert C&C communications within TLS / SSL tunnels (C&C communications are how malware, such as Trojans and botnets, receive instructions from attackers), making it difficult to respond promptly to new attacks such as encrypted traffic deformation or zero-day vulnerabilities.

[0055] In addition, due to the lack of a unified semantic representation space, existing heterogeneous graph technologies are unable to bridge the data barriers between different protocols and effectively associate abnormal behaviors in multi-protocol traffic, which limits the dynamic tracking capability of attack chains and leads to inefficient identification and tracing of multi-protocol attack chains.

[0056] To address this issue, embodiments of the present application provide a network traffic detection method, apparatus, device, and storage medium. First, a real-time dynamic graph, a semantic graph, and the network traffic data to be detected are obtained. The real-time dynamic graph represents the dynamic connection relationships among multiple network entities, while the semantic graph represents the connection relationships between the semantic vectors corresponding to these entities. Second, a structured representation vector is assigned to each network entity in the real-time dynamic graph, reflecting the topological dependencies between these entities. Then, for each network entity, the structured representation vector, the corresponding semantic vector in the semantic graph, and the semantic vectors of its adjacent entities are fused to generate a fused feature. Next, a semantic understanding model is used to perform semantic analysis and pattern learning on the fused feature to generate network behavior anomaly detection rules. Finally, these detection rules are used to perform behavior determination and anomaly detection on the network traffic data to generate detection results. By leveraging the dynamically changing connection relationships between network entities (the real-time dynamic graph) and the corresponding semantic vector relationships (the semantic graph), the present application can more accurately reflect the time-varying characteristics and deep semantic information of network traffic, thereby overcoming the limitations of static topological structures. Specifically, the real-time dynamic graph captures the changing connection relationships between network entities, while the semantic graph contains the semantic vector relationships between these entities. At the same time, by combining the connections between semantic graphs and semantic vectors and analyzing the fused features using a semantic understanding model, we can effectively identify the semantic content in encrypted traffic, thereby identifying covert malicious communications and new attacks. This approach not only enhances the detection of covert command and control (C&C) communications in encrypted traffic, but also improves the understanding of complex network behavior. Furthermore, by fusing structured representation vectors with semantic vectors and using a semantic understanding model for pattern learning, this method can effectively correlate anomalous behaviors in multi-protocol traffic, significantly improving the efficiency of identifying and tracing multi-protocol attack chains.

[0057] The following will be combined with the accompanying drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0058] See also Figure 1 , which is a flow chart of a method for detecting network traffic provided by an embodiment of the present application, such as Figure 1 As shown, the network traffic detection method may include steps S101-S105:

[0059] S101: Acquire a real-time dynamic graph, a semantic graph, and network traffic data to be detected.

[0060] To effectively monitor network traffic, it's first necessary to acquire a real-time dynamic graph, a semantic graph, and the network traffic data to be monitored. The real-time dynamic graph dynamically captures the ever-changing connectivity between multiple network entities, accurately reflecting the interaction status of devices and nodes in the network environment. These network entities can include, but are not limited to, IP addresses, port numbers, and protocol types. The connectivity between them dynamically adjusts as network traffic and behavior change, ensuring accurate capture of the temporal characteristics of the network topology. Simultaneously, the semantic graph constructs a corresponding semantic vector for each network entity in the real-time dynamic graph, and then forms the connectivity between these semantic vectors. These semantic vectors embody the functional attributes, behavioral characteristics, and underlying semantic information of the network entities. The connectivity between these semantic vectors reveals deeper semantic dependencies and associations between different network entities, providing critical support for understanding complex network behavior. By simultaneously acquiring these two graph structures and raw network traffic data, the system can effectively combine spatiotemporal dynamics with rich semantic information, laying a solid data foundation for subsequent anomaly identification and security analysis, and improving detection accuracy and reliability.

[0061] S102: configuring a structured representation vector for each network entity in the real-time dynamic graph.

[0062] To fully characterize the characteristics of each network entity and their interrelationships in a real-time dynamic graph, a structured representation vector must be constructed for each network entity. These network entities typically include key network attributes such as IP addresses, port numbers, and protocol types. By encoding this attribute information, the structured representation vector transforms discrete and diverse data into a unified numerical representation, facilitating computation and analysis. Specifically, for each IP address, information such as its corresponding geographic location, subnet, and historical communication behavior can be integrated into the vector; the port number reflects the type of network service and access rights; and the protocol type reflects the rules and characteristics of data transmission. In this way, the structured representation vector not only encompasses a single attribute but also integrates information from multiple dimensions, enabling a comprehensive and detailed description of each network entity.

[0063] Furthermore, network entities in real-time dynamic graphs do not exist in isolation. Instead, they are generated through feature aggregation based on the topological structure (adjacency) between entities. This connectivity manifests as a topological dependency between structured representation vectors, comprehensively reflecting the structure and attribute information of the nodes. In other words, an entity's vector is influenced not only by its own attributes but also by the vectors of other entities directly or indirectly connected to it. This topological dependency reflects the actual interactions and communication paths within the network and is a key factor in understanding the overall network structure and behavior. For example, in a network communication, client IP address A accesses server IP address B via port 80 (HTTP protocol). When constructing the structured representation vector, client A's vector includes its IP address attributes and related historical access information, the port 80 vector reflects HTTP protocol characteristics, and the server B vector includes information such as its IP address, open ports, and service type. Because client A and server B are connected via port 80, their structured vectors form a close topological dependency, reflecting their direct connection and functional synergy in network communication. This attribute- and topology-based vector representation not only accurately describes the characteristics of a single entity, but also reveals the complex and dynamic interaction structure between nodes in the network, providing rich and powerful support for subsequent feature fusion and anomaly detection.

[0064] S103: For each network entity in the real-time dynamic graph, feature fusion is performed on the structured representation vector of the network entity, the semantic vector corresponding to the network entity in the semantic graph, and the adjacent semantic vectors of the network entity to obtain a fused feature.

[0065] For each network entity in a real-time dynamic graph, its multi-dimensional information can be effectively integrated to more comprehensively characterize the entity's characteristics. Specifically, the structured representation vector of the network entity and the adjacency matrix between entity nodes are first obtained to reflect the entity's basic attributes and its positional relationships in the network topology. Second, the semantic vector corresponding to the entity in the semantic graph is extracted. This semantic vector contains higher-level semantic information, such as the entity's functional role, behavioral patterns, and potential semantic meaning. Finally, the semantic vectors corresponding to all neighboring network entities connected to the entity in the real-time dynamic graph (i.e., the adjacency matrix) are collected. These neighboring semantic vectors represent the semantic characteristics of other entities that directly interact or are associated with the target entity. By fusing these three types of vectors—the structured representation vector, the ontology semantic vector, and the semantic vectors of neighboring entities—a richer and more contextually relevant fusion feature can be formed, which more accurately represents the comprehensive characteristics of the network entity and its semantic context within the entire network environment.

[0066] S104: Using a semantic understanding model to perform semantic analysis and pattern learning on the fusion features to obtain network behavior anomaly detection rules.

[0067] After obtaining the fused features, a semantic understanding model is then used to conduct in-depth semantic analysis and pattern learning on these fused features to uncover underlying patterns in network behavior and identify anomalies. The semantic understanding model combines the information carried by structured representation vectors and semantic vectors to understand the behavioral characteristics reflected by network entities and their interactions from a multi-dimensional and multi-layered perspective. By training on a large amount of normal and anomalous network behavior data, the model automatically captures typical and anomalous patterns in network traffic, including time series changes, access frequency, communication paths, and complex associations between entity semantic roles. After learning, the model develops a set of effective rules for detecting network behavior anomalies. These rules not only cover significant anomaly indicators but also incorporate semantic dependencies and topological relationships between network entities, resulting in enhanced generalization and accuracy.

[0068] For example, suppose the fusion features reflect that a server node normally communicates primarily with a specific group of clients, with stable access protocols and port types. However, the semantic understanding model discovers through learning that when the server suddenly begins communicating with a large number of unknown clients at high speed and using an atypical combination of protocols, this behavior deviates from the existing pattern. Based on this discovery, the semantic understanding model generates an anomaly detection rule: If the fusion features of the server node show an abnormal surge in the number of connections and protocol anomalies, it is determined to be a potential network attack or abnormal behavior. Through such rules, the system can monitor and warn of abnormal behavior in the network in real time, effectively improving the intelligent level of network security protection.

[0069] S105: Using the network behavior anomaly detection rule, the network traffic data to be detected is subjected to behavior determination and anomaly detection to obtain a detection result.

[0070] In actual application, based on the network behavior anomaly detection rules generated by the aforementioned semantic understanding model, the system can perform comprehensive behavioral judgments and anomaly detection on the network traffic data to be tested. Specifically, the learned and formed anomaly detection rules can be used to rigorously analyze and identify each network entity and its interactive behavior in the network traffic data to be tested. By matching the behavioral patterns in the traffic data with predefined normal behavior characteristics, the system can quickly identify abnormal behaviors that deviate from the normal pattern, such as abnormal access, high-frequency connections, and unauthorized protocol use. Once an anomaly is discovered, the system generates corresponding detection results. These results not only include the existence of an anomaly, but also provide a detailed description of the anomaly type, the network entities involved, and the severity of the anomaly, thereby providing a scientific basis and decision support for network security response.

[0071] Based on the contents of S101-S105, it can be seen that the real-time dynamic graph, the semantic graph and the network traffic data to be detected are first obtained; the real-time dynamic graph contains the connection relationship of multiple dynamic network entities, and the semantic graph contains the connection relationship between the semantic vectors corresponding to these network entities. Next, a structured representation vector is configured for each network entity in the real-time dynamic graph, and these structured representation vectors have a topological dependency relationship. Then, for each network entity in the real-time dynamic graph, the structured representation vector of the network entity, its corresponding semantic vector in the semantic graph, and the semantic vectors of the adjacent network entities with a link relationship are fused to obtain a fused feature. The semantic understanding model is used to perform semantic analysis and pattern learning on the fused feature to generate a network behavior anomaly detection rule. Finally, the generated network behavior anomaly detection rule is used to perform behavior judgment and anomaly detection on the network traffic data to be detected to obtain the detection result. This application effectively breaks through the limitation that the traditional static topology is difficult to capture the hidden semantic information in encrypted traffic, and improves the ability to identify covert malicious communications and new attacks. At the same time, cross-protocol data association is achieved through a unified semantic space, which greatly enhances the efficiency of dynamic tracking and tracing of multi-protocol attack chains, fundamentally solving the shortcomings of existing technologies in accuracy, dynamic adaptability and multi-protocol collaborative analysis.

[0072] In a possible implementation, the present application also provides a vector feature fusion method, see Figure 2 , Figure 2 This is a method flow chart of a vector feature fusion method provided in an embodiment of the present application. Accordingly, step S103 performs feature fusion on each network entity in the real-time dynamic graph, including the structured representation vector of the network entity, the semantic vector corresponding to the network entity in the semantic graph, and the adjacent semantic vectors of the network entity, to obtain a fused feature. This can be achieved through steps S201-S202:

[0073] S201: For each network entity in the real-time dynamic graph, the interaction between the structured representation vector of the network entity and the semantic vector corresponding to the network entity in the semantic graph is modeled and calculated by GAT to obtain the attention coefficient of the network entity.

[0074] For each network entity in the real-time dynamic graph, the system uses the Graph Attention Network (GAT) to model and calculate the interaction between the structured representation vector of the entity and its corresponding semantic vector in the semantic graph, thereby calculating the attention coefficient of the network entity. This process aims to introduce an attention mechanism to selectively highlight the importance of different feature dimensions and achieve effective fusion of multi-source information. Specifically, the structured representation vector of the network entity is first recorded as , which represents the structural features of the entity; similarly, the semantic vector corresponding to the entity in the semantic graph is recorded as , representing its high-level semantic features. Through the parameter matrix W q and W k Perform linear transformation on these two types of vectors and map them into a unified feature space. The formula is:

[0075] a ij= softmax( );

[0076] Among them, a ij represents the attention coefficient of node i to node j, which is used to measure the correlation and importance between the features of the two; d is the dimension of the feature space, which is used to normalize the dot product result to avoid excessive values ​​affecting the training stability; W q and W k is a trainable weight matrix, responsible for the structured representation vector and semantic vectors The linear transformation of ; i represents the currently concerned network entity, j is the index of all possible related entities in the semantic graph, and the weights of all neighbor nodes are normalized by the softmax function to ensure that the attention coefficient is between 0 and 1 and the sum is 1.

[0077] S202: For each network entity in the real-time dynamic graph, combined with the attention coefficient of the network entity, the semantic vector of the network entity and the adjacent semantic vectors of the network entity are weightedly summed through the GAT to obtain the fusion feature.

[0078] For each network entity in the real-time dynamic graph, combined with the attention coefficient previously calculated for the entity, the system uses GAT to perform a weighted summation of the semantic vector of the network entity itself and the semantic vectors corresponding to the adjacent network entities in the real-time dynamic graph to generate a fusion feature. This process effectively integrates the semantic information of the entity itself with the contextual semantics of the neighboring nodes by introducing the attention mechanism, thereby more accurately and richly expressing the multi-dimensional characteristics of the network entity in the dynamic network environment. Specifically, assuming that a network entity is node i, its corresponding semantic vector is , and the set of adjacent network entities in the real-time dynamic graph is {j=1,2,...,N}, and the semantic vector of the adjacent node is . Combined with the previously calculated attention coefficient a ij , represents the importance of node i to the semantic vector of neighbor node j. GAT performs weighted summation of these semantic vectors using the following formula to generate fusion features:

[0079] H fusion = ;

[0080] Among them, H fusion is the fusion feature vector of node i, which comprehensively reflects the semantic information of the node itself and its neighboring nodes; W v It is a trainable weight matrix used to perform linear transformation on semantic vectors to improve the expressive power; a ij is the attention coefficient calculated in the previous step, which ensures that the semantic information of neighbor nodes is reasonably weighted according to their relevance; i represents the current network entity, and j traverses all neighbor entities that have a connection relationship with node i in the real-time dynamic graph.

[0081] In a possible implementation, this application also provides a method for training a semantic understanding model, see Figure 3 , Figure 3 A flowchart of a method for training a semantic understanding model provided in an embodiment of the present application can be implemented through steps S301-S303:

[0082] S301: Configuring a threat knowledge base for LMM.

[0083] To enhance the semantic understanding and threat detection capabilities of large language models (LMMs) in cybersecurity, a key step is to equip them with a systematic and authoritative threat knowledge base, such as the widely used MITRE Adversarial Tactics, Techniques, and Common Knowledge (MITRE ATT&CK) framework. This knowledge base contains a large number of validated and categorized attack techniques, tactics, and procedures (TTPs), detailing the various methods, attack paths, vulnerability exploits, and corresponding defensive measures that attackers may employ. This structured threat information can be injected into the LMM as prior knowledge, enabling it to not only rely on sample features in the training data but also possess the contextual understanding and reasoning capabilities required for complex attack behaviors.

[0084] Specifically, by mapping threat data from the MITRE ATT&CK framework into a machine-readable knowledge representation and integrating it into the semantic understanding module of the LMM, the model can identify and understand potential attack patterns and anomalous behaviors in network traffic. For example, when analyzing real-time network traffic or logs, the model can draw on the typical behavioral sequences and indicators of a particular attack type in the knowledge base to more accurately determine whether malicious operations are present, thereby improving the accuracy and timeliness of detection. Furthermore, the threat knowledge base allows the model to infer the similarities between known attack techniques when facing unknown or variant attacks, effectively enhancing the model's generalization and adaptability.

[0085] Therefore, configuring a comprehensive threat knowledge base such as MITRE ATT&CK for the large language model not only provides it with a rich and systematic security knowledge resource, but also gives the model stronger contextual understanding and logical reasoning capabilities, greatly improving the overall intelligence level of network threat identification and protection effects.

[0086] S302: Obtain a training data set.

[0087] Acquiring a high-quality, well-labeled training dataset is crucial for training semantic understanding models. This training dataset should contain two broad categories of samples: positive samples labeled with malicious behavior and negative samples labeled with normal behavior. Positive samples refer to abnormal network traffic data that includes network attack events. These data typically reflect traces of malicious behavior such as intrusion, lateral movement, data theft, or destruction by attackers. For example, abnormal traffic spikes generated during distributed denial of service (DDoS) attacks, large numbers of invalid connection requests generated by port scanning activities, and abnormal file transfer behavior during malware propagation are all typical positive samples. These samples provide the model with clear attack characteristics, enabling it to learn the semantic patterns and manifestations of malicious behavior.

[0088] Negative samples, in contrast, encompass normal network traffic data—that is, legitimate user behavior and system communications in a non-attack state. This includes everyday network interactions like web browsing requests, email transmissions, and database accesses. These negative samples allow the model to understand and distinguish between normal and abnormal behavior, avoiding false positives due to oversensitivity, thereby improving detection accuracy and robustness.

[0089] For example, a corporate network might collect traffic data over a period of time, including normal employee internet access using office software, as well as abnormal traffic generated by an advanced persistent threat attack targeting an internal server. These two types of data are labeled "normal" and "malicious," respectively, to form a complete training dataset. By learning from this data, the model can gradually grasp the semantic characteristics of different types of attacks and how they differ from normal traffic, effectively identifying and warning against unknown threats. Therefore, scientifically and rationally constructing a training dataset that includes both positive and negative examples is fundamental to improving the threat detection capabilities of semantic understanding models.

[0090] S303: Using the training data set as a model input and combining it with a loss function, the LMM configured with the threat knowledge base is trained to obtain the semantic understanding model with threat detection capability.

[0091] During the semantic understanding model training process, a pre-prepared training dataset is first fed into a large language model (LMM) configured with a threat knowledge base. Through iterative optimization, the model gradually improves its ability to identify cyber threats. Because the LMM incorporates a systematic and authoritative threat knowledge base, such as attack tactics and techniques from the MITRE ATT&CK framework, the model not only learns based on the input data but also incorporates rich security background knowledge for deeper semantic understanding and reasoning, enabling more accurate threat detection.

[0092] The training process relies on a well-designed and effective loss function to guide the model to continuously adjust internal parameters and improve the discrimination effect. Specifically, the total loss function L used is composed of two parts: classification loss L cls and contrastive learning loss L contrast , that is, L=L cls +λ·L contrast ;

[0093] Among them, λ is a hyperparameter used to balance the cross entropy loss L cls and contrastive learning loss L contrast The weight between them. cls Cross-Entropy Loss is used to supervise the model's ability to correctly distinguish between positive samples labeled malicious and negative samples labeled normal. This improves classification accuracy by penalizing misclassifications. For example, if the model misclassifies normal network traffic as malicious, the cross-entropy loss increases, prompting the model to modify its parameters to reduce these false positives.

[0094] On the other hand, L contrastContrastive learning loss optimizes the structure of the feature space, causing the feature vectors of similar samples (such as all normal traffic or all attack traffic) to cluster more closely in the embedding space, while increasing the feature distance between samples of different types. This approach effectively enhances the model's discriminative boundaries and generalization capabilities, enabling it to infer and identify even unseen attack types based on semantic similarity. For example, even if a new type of network attack data does not appear in the training set, the model can still effectively identify it as an anomaly because its feature vector is similar to known attack samples.

[0095] In summary, by feeding well-labeled training data into an LMM integrated with a threat knowledge base and jointly training it using a dual loss function of classification and contrastive learning, the resulting semantic understanding model possesses powerful threat detection capabilities. This model not only accurately distinguishes between normal and malicious network behavior but also leverages semantic relationships to capture potential complex attack methods, enabling efficient and intelligent network security protection.

[0096] In a possible implementation, this application also provides a method for constructing a real-time dynamic graph, see Figure 4 , Figure 4 A method flow chart of a real-time dynamic graph construction method provided in an embodiment of the present application can be implemented through steps S401-S403:

[0097] S401: Acquire interaction characteristics of each network entity in real-time network traffic data.

[0098] Capturing the interaction characteristics of each network entity in real-time network traffic data is a critical first step in building a real-time dynamic graph. Network entities typically refer to various nodes involved in network communication, such as hosts, servers, IP addresses, ports, or application processes. By meticulously monitoring and analyzing the communication behavior between these entities, we can extract rich interaction characteristics that comprehensively reflect the dynamic state of network activity. These interaction characteristics primarily include, but are not limited to, interaction frequency, duration, and number of bytes transmitted.

[0099] Specifically, interaction frequency describes the number of times two network entities communicate per unit time. This metric can intuitively reveal the level of activity in interactions between entities. For example, under normal circumstances, the request-response frequency between the client and the server should remain stable; however, under abnormal circumstances, such as explosive port scans or DDoS attacks, the interaction frequency will increase significantly, becoming a signal of a potential threat. Duration measures the length of time from the establishment to the disconnection of a communication connection, which is important for distinguishing normal long-connection services (such as video streaming) from abnormal short-term, large-scale connections (such as malicious scans). In addition, the number of bytes transmitted reflects the actual amount of data exchanged during the interaction, which can help analyze whether there are abnormal surges in traffic or abnormal packet sizes, further assisting in identifying security incidents such as data leaks and botnet communications.

[0100] By collecting and calculating these interaction features in real time, we can construct a multidimensional feature space reflecting the behavior of network entities, providing the underlying data support for the subsequent construction of dynamic graphs. Such features not only reveal the direct interactions between entities in the network, but also capture potential attack patterns and abnormal behaviors through dynamic changes, thus laying a solid data foundation for security monitoring and threat detection, and achieving accurate perception and timely response to network security situations.

[0101] S402: Constructing connection relationships between the network entities according to the interaction characteristics of the network entities to obtain the real-time dynamic graph.

[0102] In the process of constructing a real-time dynamic graph, establishing connections between network entities based on the interaction features extracted between them is a key step in expressing dynamic network structures. Specifically, network entities must first be viewed as nodes in the dynamic graph. Each node represents a host, port, or other key communication object in the network, while the edges between these nodes correspond to the actual interactions between entities. Using previously acquired interaction features such as interaction frequency, duration, and number of bytes transferred, we can scientifically determine whether there is a connection between nodes, as well as the weight and properties of the connection.

[0103] For example, when the interaction frequency between two network entities exceeds a preset threshold, it can be assumed that a valid communication link exists between them, and an edge is added to the dynamic graph. The edge weight can be assigned based on the interaction frequency or the amount of data transmitted. This not only expresses the existence of a connection between nodes, but also reflects the strength and importance of the interaction. At the same time, the duration of the interaction can also be used as an edge attribute to help describe the stability and durability of the connection, thereby distinguishing between temporary and sporadic communications and long-term stable connections. In addition, by combining multiple interaction characteristics for comprehensive judgment, it is possible to more accurately capture the complex and changing communication patterns in the network environment, avoid the generation of false connections, and improve the authenticity and effectiveness of dynamic graph representation.

[0104] Ultimately, the real-time dynamic graph constructed using this method not only possesses structural coherence but also carries rich dynamic interaction information, clearly depicting the behavioral relationships and evolutionary trends between network entities. This dynamic graph, as the foundational data structure, provides an intuitive and efficient representation for subsequent security analysis, anomaly detection, and threat mining. It significantly enhances the perception and response speed of real-time network situations, helps promptly identify potential security risks and their propagation paths, and enables more precise and intelligent network protection.

[0105] S403: At intervals of a preset time period, the interaction characteristics of each network entity in the real-time network traffic are obtained again to obtain the latest interaction data, and the real-time dynamic graph is updated using the latest interaction data.

[0106] To ensure that real-time dynamic graphs accurately reflect the dynamic changes and current state of the network environment, a periodic update mechanism must be implemented. This involves recollecting network traffic data at predetermined intervals to capture the latest interaction characteristics of each network entity. This predetermined interval should be appropriately selected based on the specific application scenario and the frequency of network traffic fluctuations, balancing data timeliness with system processing capacity. By continuously collecting the latest interaction data, such as interaction frequency, connection duration, and number of bytes transferred, the real-time evolution of entity behavior and communication relationships within the network can be captured, enabling the timely identification of new anomalous patterns or signs of attack.

[0107] After obtaining the latest interaction data, it needs to be integrated into the existing dynamic graph structure, and the connections between nodes need to be added, deleted, modified, and checked. Specifically, new interactions will result in the addition of edges or adjustments to the weights in the graph, while inactive or disappeared interactions may cause certain edges to be deleted or their weights to be reduced. This ensures that the dynamic graph always maintains the latest network entity relationships and interaction strengths. Furthermore, the update process should consider the fusion strategy of historical and new data to avoid frequent and drastic changes in the graph structure caused by short-term fluctuations, thereby improving the stability and continuity of the dynamic graph.

[0108] Through this periodic update process, the real-time dynamic graph can dynamically adapt to changes in network traffic, effectively reflecting the latest state of interactions between entities, and providing a solid foundation for subsequent dynamic graph-based security analysis, threat detection, and abnormal behavior mining. This dynamic maintenance not only improves the model's sensitivity and response speed to sudden security incidents, but also enhances the accuracy and practicality of overall network situational awareness, enabling all-round, all-encompassing monitoring and protection of complex and changing network environments.

[0109] In a possible implementation, this application also provides a method for constructing a semantic graph, see Figure 5 , Figure 5A flowchart of a method for constructing a semantic graph provided in an embodiment of the present application can be implemented through steps S501-S503:

[0110] S501: Acquire network protocol data of each network entity in the real-time network traffic data.

[0111] In the process of building a semantic graph, obtaining network protocol data for each network entity in real-time network traffic data is a fundamental preparatory step for achieving deep semantic analysis. Network protocol data, the data carrier transmitted between these entities, covers a rich range of protocol-level content, such as application-layer HTTP header information, DNS query requests and responses, and SSL and TLS certificate details. These data reflect the specific semantics and behavioral characteristics of network communications, forming a rich and detailed source of protocol data.

[0112] By capturing and analyzing real-time network traffic, the system can extract the complete protocol stack data generated by each network entity during communication. This process typically involves packet capture tools (such as tcpdump and Wireshark) or network monitoring equipment to intercept data packets from high-speed network flows in real time, decode and organize them at the protocol level, and assign relevant protocol data to the corresponding network entity based on entity identifiers (such as IP addresses, port numbers, and session IDs). Acquiring protocol data involves not only reading static fields but also paying attention to the contextual associations and interaction sequences between protocols to ensure the captured information is sufficiently complete and timely.

[0113] This step is crucial for the subsequent accurate semantic parsing using semantic understanding models. Based on detailed and accurate protocol data, the model can deeply explore the semantic meaning behind network communications, such as request purpose, data transmission intent, and potential abnormal behavior patterns. Therefore, scientifically and efficiently acquiring network protocol data from each network entity from real-time network traffic is a key prerequisite for building a semantic graph, providing a solid data foundation for network threat detection and defense.

[0114] S502: Perform semantic analysis on each network protocol data using the semantic understanding model to obtain a semantic vector of each network protocol data.

[0115] Using semantic understanding models to perform semantic parsing of individual network protocol data is a key step in achieving deep semantic understanding and intelligent analysis of network traffic. First, network protocol data typically contains rich and complex information, including multiple layers of protocol fields, interaction content, and contextual relationships. This data is inherently structured or semi-structured symbolic, making it difficult to directly use for high-level reasoning in machine learning models. To enable computers to effectively understand and mine the underlying semantic information, advanced semantic understanding models are required to perform multi-dimensional decoding and feature extraction on network protocol data.

[0116] Specifically, this semantic understanding model transforms raw protocol data into points in a high-dimensional continuous vector space, known as semantic vectors. This process not only considers the grammatical structure of protocol fields but also fully integrates the contextual relationships between protocols and the communication intent, ensuring that each semantic vector accurately reflects the meaning and functional attributes of the corresponding protocol data. For example, for the protocol data of an HTTP request, the semantic vector not only expresses the basic parameters of the request but may also imply the access target, operation type, and even potential abnormal behavior.

[0117] S503: Constructing a connection relationship between the semantic vectors according to the correlation between the semantic vectors to obtain the semantic graph.

[0118] In the process of constructing a semantic graph, establishing connections based on the correlations between semantic vectors is a key step in expressing the deep semantic structure of network protocol data. Semantic vectors, as high-dimensional representations of network protocol data processed by a semantic understanding model, not only contain rich semantic information about individual protocol data but also imply the underlying logical and behavioral connections between different protocol interactions. By analyzing multi-dimensional correlations such as causal relationships and similarities between these vectors, we can scientifically reveal the complex semantic interaction patterns between network entities, thereby constructing a graphical model—a semantic graph—that reflects the semantic structure of real-world network communications.

[0119] Specifically, causal relationships characterize the temporal sequence, event triggering, or dependency order between semantic vectors, meaning that a certain network protocol interaction may directly lead to the occurrence of another interaction. For example, there is a clear causal chain between the semantic vector of a DNS query request and the semantic vector of its corresponding DNS response. This relationship can help the model capture the process of protocol operations and their evolution. Semantic similarity measures the proximity of different semantic vectors in the semantic space, reflecting their consistency in function, purpose, or characteristics. This similarity relationship is important for identifying similar attack methods, repetitive behavior patterns, or abnormal traffic, because data with highly similar semantic vectors often corresponds to similar network behaviors or security incidents.

[0120] By leveraging metrics such as causality or similarity, semantic vectors can be used as nodes, and the semantic relevance between them can be assigned as edge attributes, thereby constructing a structured and dynamic semantic graph. This graph not only displays the static semantic characteristics of network protocol data, but also reveals the logical relationships and temporal evolution behind complex interactions, providing a clear and comprehensive semantic picture of the entire network communication environment. By continuously updating and optimizing this semantic graph, the system can achieve precise semantic reasoning and anomaly detection, providing strong support for network security protection, greatly improving the ability to identify covert attacks and complex threats, and realizing intelligent and efficient network situational awareness.

[0121] See also Figure 6 , Figure 6 This is a schematic diagram of the structure of a network traffic detection device provided in an embodiment of the present application. Figure 6 As shown, the network traffic detection device includes:

[0122] The first acquisition unit 601 is configured to acquire a real-time dynamic graph, a semantic graph, and network traffic data to be detected; the real-time dynamic graph includes a dynamic connection relationship between multiple network entities; the semantic graph includes a connection relationship between semantic vectors corresponding to each network entity in the real-time dynamic graph;

[0123] The structured representation vector configuration unit 602 is configured to configure a structured representation vector for each network entity in the real-time dynamic graph; the structured representation vectors of each network entity in the real-time dynamic graph have a topological dependency relationship;

[0124] A feature fusion unit 603 is configured to, for each network entity in the real-time dynamic graph, fuse the structured representation vector of the network entity, the semantic vector corresponding to the network entity in the semantic graph, and the adjacent semantic vectors of the network entity to obtain a fused feature; the adjacent semantic vectors of the network entity are the semantic vectors corresponding to the network entities that have a connection relationship with the network entity in the real-time dynamic graph;

[0125] A detection rule generating unit 604 is configured to perform semantic analysis and pattern learning on the fusion features using a semantic understanding model to obtain a network behavior anomaly detection rule;

[0126] The detection unit 605 is configured to perform behavior determination and anomaly detection on the network traffic data to be detected by using the network behavior anomaly detection rule to obtain a detection result.

[0127] In a possible implementation, the feature fusion unit 603 specifically includes:

[0128] an attention coefficient calculation unit, configured to model and calculate, for each network entity in the real-time dynamic graph, the interaction between the structured representation vector of the network entity and the semantic vector corresponding to the network entity in the semantic graph using GAT, to obtain an attention coefficient for the network entity;

[0129] The fusion feature calculation unit is used to perform weighted summation of the semantic vector of the network entity and the adjacent semantic vectors of the network entity through the GAT for each network entity in the real-time dynamic graph, in combination with the attention coefficient of the network entity, to obtain the fusion feature.

[0130] In a possible implementation, the apparatus further includes:

[0131] A knowledge base configuration unit is used to configure a threat knowledge base for the large language model LMM;

[0132] A second acquisition unit is configured to acquire a training data set; the training data set includes positive samples with malicious behavior labels and negative samples with normal behavior labels; the positive samples include abnormal network traffic data carrying network attack events; and the negative samples include normal network traffic data;

[0133] A model training unit, configured to use the training data set as a model input and, in combination with a loss function, perform model training on the LMM configured with the threat knowledge base to obtain the semantic understanding model with threat detection capability;

[0134] The loss function is: L=Lcls+Lcontrast, Lcls is the cross entropy loss, and Lcontrast is the contrast learning loss.

[0135] In a possible implementation, the apparatus further includes:

[0136] An interaction feature acquisition unit, configured to acquire interaction features of each network entity in real-time network traffic data;

[0137] A real-time dynamic graph construction unit, configured to construct connection relationships between the network entities according to interaction characteristics of the network entities to obtain the real-time dynamic graph;

[0138] The updating unit is used to obtain the interaction characteristics of each network entity in the real-time network traffic again at intervals of a preset time period to obtain the latest interaction data, and update the real-time dynamic graph using the latest interaction data.

[0139] In a possible implementation, the apparatus further includes:

[0140] A network protocol data acquisition unit, configured to acquire network protocol data of each network entity in the real-time network traffic data;

[0141] A semantic parsing unit, configured to perform semantic parsing on each network protocol data using the semantic understanding model to obtain a semantic vector of each network protocol data;

[0142] The semantic graph construction unit is used to construct a connection relationship between semantic vectors according to the correlation between semantic vectors to obtain the semantic graph.

[0143] In addition, an embodiment of the present application also provides a network traffic detection device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the network traffic detection method described above is implemented.

[0144] In addition, an embodiment of the present application further provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a terminal device, the terminal device executes the network traffic detection method described above.

[0145] This application constructs a real-time dynamic graph by introducing dynamically changing network entity connection relationships, and combines it with a semantic graph that reflects the relationship between semantic vectors. It can more comprehensively capture the temporal characteristics and deep semantic information of network traffic, breaking through the limitations of traditional static topological structures. At the same time, by utilizing the connection relationship of semantic vectors in the semantic graph and coordinating with the semantic understanding model to conduct in-depth analysis of the fused features, it is possible to effectively identify the implicit semantics in encrypted traffic, thereby accurately discovering hidden malicious communications and new attacks. In addition, by fusing the structured representation vector with the semantic vector, and relying on the pattern learning ability of the semantic understanding model, it is possible to effectively associate abnormal behaviors under different protocols, greatly improving the efficiency of identifying and tracing multi-protocol attack chains.

[0146] The above is a detailed introduction to a network traffic detection method, device, equipment and storage medium provided by the present application. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of this application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of this application.

[0147] It should be understood that in this application, "at least one (item)" means one or more, and "more" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships can exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or plural.

[0148] It should also be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

Claims

1. A method for detecting network traffic, characterized in that: The method comprises: Acquire a real-time dynamic graph, a semantic graph, and network traffic data to be detected; the real-time dynamic graph includes dynamic connection relationships between multiple network entities; the semantic graph includes connection relationships between semantic vectors corresponding to each network entity in the real-time dynamic graph; Configuring a structured representation vector for each network entity in the real-time dynamic graph; wherein the structured representation vectors of each network entity in the real-time dynamic graph have a topological dependency relationship; For each network entity in the real-time dynamic graph, feature fusion is performed on the structured representation vector of the network entity, the semantic vector corresponding to the network entity in the semantic graph, and the adjacent semantic vectors of the network entity to obtain a fused feature; the adjacent semantic vectors of the network entity are: semantic vectors corresponding to network entities that have a connection relationship with the network entity in the real-time dynamic graph; Using a semantic understanding model to perform semantic analysis and pattern learning on the fusion features to obtain network behavior anomaly detection rules; The network behavior anomaly detection rules are used to perform behavior determination and anomaly detection on the network traffic data to be detected to obtain a detection result.

2. The method according to claim 1, characterized in that For each network entity in the real-time dynamic graph, feature fusion is performed on the structured representation vector of the network entity, the semantic vector corresponding to the network entity in the semantic graph, and the adjacent semantic vectors of the network entity to obtain a fused feature, including: For each network entity in the real-time dynamic graph, the interaction between the structured representation vector of the network entity and the semantic vector corresponding to the network entity in the semantic graph is modeled and calculated using the graph attention network (GAT) to obtain the attention coefficient of the network entity; For each network entity in the real-time dynamic graph, combined with the attention coefficient of the network entity, the semantic vector of the network entity and the adjacent semantic vectors of the network entity are weightedly summed through the GAT to obtain the fusion feature.

3. The method according to claim 1, characterized in that The training process of the semantic understanding model includes: Configure a threat knowledge base for the large language model LMM; Obtain a training data set; the training data set includes positive samples with malicious behavior labels and negative samples with normal behavior labels; the positive samples include abnormal network traffic data carrying network attack events; the negative samples include normal network traffic data; Using the training data set as a model input and combining it with a loss function, the LMM configured with the threat knowledge base is trained to obtain the semantic understanding model with threat detection capability; Wherein, the loss function is: L=L cls +λ·L contrast , L cls is the cross entropy loss, L contrast is the contrastive learning loss.

4. The method according to claim 1, wherein The construction process of the real-time dynamic graph includes: Obtain the interaction characteristics of each network entity in real-time network traffic data; Constructing connection relationships between the network entities according to interaction characteristics of the network entities to obtain the real-time dynamic graph; At intervals of a preset time period, the interaction characteristics of each network entity in the real-time network traffic are obtained again to obtain the latest interaction data, and the real-time dynamic graph is updated using the latest interaction data.

5. The method according to claim 4, characterized in that The process of constructing the semantic graph includes: Acquire network protocol data of each network entity in the real-time network traffic data; Performing semantic analysis on each network protocol data using the semantic understanding model to obtain a semantic vector of each network protocol data; The connection relationship between the semantic vectors is constructed according to the correlation between the semantic vectors to obtain the semantic graph.

6. A network traffic detection device, characterized in that: The device comprises: A first acquisition unit is configured to acquire a real-time dynamic graph, a semantic graph, and network traffic data to be detected; the real-time dynamic graph includes a dynamic connection relationship between multiple network entities; the semantic graph includes a connection relationship between semantic vectors corresponding to each network entity in the real-time dynamic graph; A structured representation vector configuration unit is configured to configure a structured representation vector for each network entity in the real-time dynamic graph; the structured representation vectors of each network entity in the real-time dynamic graph have a topological dependency relationship; a feature fusion unit configured to, for each network entity in the real-time dynamic graph, fuse the structured representation vector of the network entity, the semantic vector corresponding to the network entity in the semantic graph, and the adjacent semantic vectors of the network entity to obtain a fused feature; the adjacent semantic vectors of the network entity are semantic vectors corresponding to network entities that have a connection relationship with the network entity in the real-time dynamic graph; A detection rule generation unit, configured to perform semantic analysis and pattern learning on the fusion features using a semantic understanding model to obtain a network behavior anomaly detection rule; The detection unit is used to use the network behavior anomaly detection rules to perform behavior judgment and anomaly detection on the network traffic data to be detected to obtain a detection result.

7. The device according to claim 6, characterized in that The feature fusion unit specifically includes: an attention coefficient calculation unit, configured to model and calculate, for each network entity in the real-time dynamic graph, the interaction between the structured representation vector of the network entity and the semantic vector corresponding to the network entity in the semantic graph through GAT, to obtain an attention coefficient of the network entity; The fusion feature calculation unit is used to perform weighted summation of the semantic vector of the network entity and the adjacent semantic vectors of the network entity through the GAT for each network entity in the real-time dynamic graph, in combination with the attention coefficient of the network entity, to obtain the fusion feature.

8. The device according to claim 6, characterized in that The device further comprises: A knowledge base configuration unit is used to configure a threat knowledge base for the large language model LMM; A second acquisition unit is configured to acquire a training data set; the training data set includes positive samples with malicious behavior labels and negative samples with normal behavior labels; the positive samples include abnormal network traffic data carrying network attack events; and the negative samples include normal network traffic data; A model training unit, configured to use the training data set as a model input and, in combination with a loss function, perform model training on the LMM configured with the threat knowledge base to obtain the semantic understanding model with threat detection capability; The loss function is: L=Lcls+Lcontrast, Lcls is the cross entropy loss, and Lcontrast is the contrast learning loss.

9. A network traffic detection device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for detecting network traffic according to any one of claims 1 to 5 is implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores instructions, and when the instructions are executed on the terminal device, the terminal device executes the network traffic detection method according to any one of claims 1 to 5.

Images