Encrypted network flow detection method and device based on improved multiple graphs, and program product

Abstract

The invention provides an encrypted network flow detection method and device based on improved multiple graphs, and a program product. The method comprises the following steps: splitting a to-be-detected encrypted network flow into at least one bidirectional network flow; extracting network flow features in each piece of bidirectional network flow information to construct a multi-graph comprising at least one node pair; each node is constructed through connection information features in the network flow features; each node pair is connected through a first type edge and a second type edge; inputting the multiple graphs into a pre-trained encrypted network flow detection model to obtain a detection result corresponding to the encrypted network flow; the encrypted network flow detection model comprises a relational graph convolutional network encoder and a multi-layer perceptron classifier. The method can solve the problems that an existing encrypted network flow detection method is large in consumption of computing resources and storage resources and poor in practicability. Accuracy and practicability of encrypted network flow detection are enhanced, and possibility is provided for real-time monitoring and quick response to potential security threats.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an encrypted network flow detection method, device and program product based on improved multigraph. Background Art

[0002] With the increasing sophistication of network attacks and the widespread adoption of encryption technology, the importance of detecting encrypted malicious traffic has become increasingly prominent. By monitoring and analyzing encrypted network traffic, security personnel can identify potential threats, detect anomalous behavior, and effectively prevent malicious attacks. However, the concealment and diversity of encrypted network traffic make accurately identifying malicious activity extremely challenging. Therefore, achieving accurate attack detection in encrypted network traffic has become a pressing need in the current cybersecurity field.

[0003] Currently, existing encrypted network flow detection methods include: using Transport Layer Security (TLS) network flows as nodes, establishing edges between nodes with the same IP address, and constructing a multi-flow pruning graph based on similarity; and detecting encrypted network flows based on the multi-flow pruning graph.

[0004] However, with the growth of the internet and the popularity of various online services, network traffic is experiencing explosive growth, leading to a sharp increase in the number of network flows. In this situation, if we continue to construct a graph structure based on network flows as nodes, the graph will become extremely large, requiring a large amount of computing and storage resources. Furthermore, large-scale graph structures may lead to inefficient subsequent traffic classification and detection, making it difficult to achieve real-time or near-real-time encrypted network flow detection, resulting in poor practicality of traffic detection. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide an improved multigraph-based encrypted network flow detection method, apparatus, and program product to eliminate or improve one or more deficiencies in the prior art. This method addresses the problem that existing encrypted network flow detection methods consume large amounts of computing and storage resources and have poor practicality.

[0006] One aspect of the present invention provides an encrypted network flow detection method based on an improved multigraph, the method comprising the following steps:

[0007] Split the encrypted network flow obtained from the network monitoring system based on a preset time window into at least one bidirectional network flow, and extract the network flow features corresponding to each bidirectional network flow; the network flow features include connection information features and interaction information features;

[0008] A multigraph including at least one node pair is constructed based on the network flow features corresponding to each bidirectional network flow; each node is constructed based on the connection information features; each node pair is connected by a first-class edge and a second-class edge, the first-class edge is used to represent different bidirectional network flows between the node pairs, the number of first-class edges between any node pair is the same as the number of bidirectional network flows between the node pairs, and the edge features of the first-class edges are the mutual information features of the corresponding bidirectional network flows; the edge features of the second-class edges are obtained based on the statistics of all the mutual information features between the node pairs;

[0009] Multiple graphs are input into a pre-trained encrypted network flow detection model to obtain classification detection results of bidirectional network flows between each node pair; the encrypted network flow detection model includes a relational graph convolutional network encoder and a multi-layer perceptron classifier; the relational graph convolutional network encoder is used to aggregate the edge features corresponding to each node in the multiple graphs, update the node representation, splice the updated node representations to obtain the interaction relationship representation between the nodes, and input the interaction relationship representation into the multi-layer perceptron classifier; the multi-layer perceptron classifier is used to classify the interaction relationship representation to obtain classification detection results of bidirectional network flows between each node pair.

[0010] In some embodiments of the present invention, connection information features include source IP address, destination IP address, source port, destination port and transport layer protocol information; interaction information features include network flow duration, number of upstream data packets, number of downstream data packets, number of upstream bytes and number of downstream bytes; based on the network flow features corresponding to each bidirectional network flow, a multigraph including at least one node pair is constructed, including: based on the connection information features corresponding to each bidirectional network flow, the number of network flows and the number of ports corresponding to each node are determined as the characteristics of the node; based on the bidirectional network flows between the nodes, first-class edges between the nodes are established, node pairs are constructed and corresponding edge features are assigned to each first-class edge; second-class edges are constructed between each node pair, and based on the edge features of the first-class edges between the node pairs, the edge features of the second-class edges are statistically calculated.

[0011] In some embodiments of the present invention, the transport layer protocol information includes the TCP protocol and the UDP protocol; based on the connection information characteristics corresponding to each bidirectional network flow, determining the number of network flows and the number of ports corresponding to each node as the node characteristics includes:

[0012] Identify all sent TCP network flows and received TCP network flows and count them to obtain the number of sent TCP network flows and the number of received TCP network flows;

[0013] Determine the number of port numbers used for sending TCP network flows and the number of port numbers used for receiving TCP network flows;

[0014] Identify all sent UDP network flows and received UDP network flows and count them to obtain the number of sent UDP network flows and the number of received UDP network flows;

[0015] Determines the number of port numbers used for sending UDP network traffic and the number of port numbers used for receiving UDP network traffic.

[0016] In some embodiments of the present invention, based on the edge features of the first type of edges between node pairs, edge features of the second type of edges are obtained by statistical calculation, including:

[0017] For all first-class edges between node pairs, perform statistical calculations on edge features uniformly to obtain statistical calculation results, including the sum, minimum, maximum, mean, and variance of each edge feature;

[0018] The statistical calculation results are used as the edge features of the second type of edges between the corresponding node pairs.

[0019] In some embodiments of the present invention, the training process of the encrypted network flow detection model includes:

[0020] Obtain training data; the training data includes: sample interaction relationship representations corresponding to malicious encrypted network flows, sample interaction relationship representations corresponding to benign encrypted network flows, and corresponding true classification labels;

[0021] Input the training data into the initial multi-layer perceptron classifier to obtain the training results;

[0022] Input the training results and the true classification labels into the cross entropy loss function to obtain the loss results;

[0023] The loss result is used to iteratively train the initial multi-layer perceptron classifier until the initial multi-layer perceptron classifier converges to obtain a multi-layer perceptron classifier;

[0024] The encrypted network flow detection model is obtained by combining the multi-layer perceptron classifier with the relational graph convolutional network encoder.

[0025] In some embodiments of the present invention, obtaining training data includes:

[0026] Construct a sample multigraph based on the sample encrypted network flow;

[0027] Input the sample multigraph into the relational graph convolutional network encoder to obtain the updated node representation corresponding to each node in the sample multigraph;

[0028] The updated node representations of each node pair in the sample multigraph are concatenated to obtain the sample interaction relationship representation and construct the training data.

[0029] In some embodiments of the present invention, the encrypted network flow obtained from the network monitoring system based on a preset time window is split into at least one bidirectional network flow, including: splitting the encrypted network flow according to five-tuples, identifying different bidirectional network flows and splitting them; the five-tuple includes the source IP address, destination IP address, source port, destination port and transport layer protocol.

[0030] Another aspect of the present invention provides an encrypted network flow detection device based on an improved multigraph, comprising a processor, a memory, and a computer program / instruction stored in the memory, wherein the processor is used to execute the computer program / instruction. When the computer program / instruction is executed, the device implements the steps of the encrypted network flow detection method based on the improved multigraph as described above.

[0031] Another aspect of the present invention provides a computer-readable storage medium having a computer program / instruction stored thereon, which implements the steps of the above-mentioned method for detecting encrypted network flows based on improved multigraph when executed by a processor.

[0032] Another aspect of the present invention provides a computer program product, comprising a computer program / instruction, which implements the steps of the above-mentioned method for detecting encrypted network flows based on improved multigraph when executed by a processor.

[0033] The beneficial effects of the present invention include at least:

[0034] The present invention provides an encrypted network flow detection method and device based on an improved multigraph, which can solve the problems of existing encrypted network flow detection methods, such as large consumption of computing and storage resources and poor practicality. Independent nodes in the multigraph are constructed by using connection information features in network flow features, so that the established multigraph can focus on the IP addresses and port numbers of the communicating parties, rather than each individual data packet or complete network flow. This greatly reduces the number of nodes in the graph, making the scale of the multigraph much smaller than that of a graph with network flows as nodes, thereby reducing the demand for computing and storage resources. At the same time, each pair of nodes is connected by at least two edges, each edge representing a different interaction mode or interaction feature, which can retain necessary detailed information, making the constructed multigraph more concise while still rich in key information. This reduces resource requirements, improves processing speed, and enhances the accuracy and practicality of encrypted network flow detection. This allows encrypted network flow detection to operate efficiently under limited resources and support larger-scale application scenarios, providing the possibility for real-time monitoring and rapid response to potential security threats, thereby further enhancing network security protection capabilities.

[0035] Additional advantages, objects, and features of the present invention will be set forth in part in the following description and will become apparent to those skilled in the art upon examination of the following or may be learned from practice of the present invention. The objects and other advantages of the present invention may be realized and obtained by the structures particularly pointed out in the description and drawings.

[0036] Those skilled in the art will understand that the purposes and advantages that can be achieved by the present invention are not limited to the above specific descriptions, and the above and other purposes that can be achieved by the present invention will be more clearly understood based on the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The drawings described herein are used to provide a further understanding of the present invention, constitute a part of this application, and do not constitute a limitation of the present invention. In the drawings:

[0038] Figure 1 The present invention provides a flowchart of an encrypted network flow detection method based on an improved multigraph according to an embodiment of the present invention.

[0039] Figure 2 A schematic diagram of nodes and edges in an improved multigraph provided by one embodiment of the present invention.

[0040] Figure 3 A schematic diagram of a relational graph convolutional network encoder according to an embodiment of the present invention. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments and the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0042] It should also be noted that, in order to avoid obscuring the present invention due to unnecessary details, the accompanying drawings only show structures and / or processing steps closely related to the solutions according to the present invention, while other details that are not closely related to the present invention are omitted.

[0043] It should be emphasized that the term “include / comprises” when used herein refers to the presence of features, elements, steps or components, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0044] It should also be noted that, unless otherwise specified, the term "connection" herein may refer not only to a direct connection but also to an indirect connection involving an intermediate.

[0045] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In the accompanying drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0046] The following is a detailed introduction to the encrypted network flow detection method based on improved multigraph provided by this application.

[0047] The execution subject of the improved multi-graph-based encrypted network flow detection method provided in this application is an electronic device, which can be a terminal such as a computer, a mobile phone, a tablet computer, a camera, or a server. This embodiment does not limit the implementation method of the electronic device.

[0048] This embodiment provides an encrypted network flow detection method based on an improved multigraph, such as Figure 1 As shown, the method at least includes steps S101 to S103:

[0049] Step S101: splitting the encrypted network flow obtained from the network monitoring system based on a preset time window into at least one bidirectional network flow, and extracting the network flow features corresponding to each bidirectional network flow.

[0050] Among them, encrypted network flow refers to data transmission protected by encryption algorithms or technologies during network communication, usually including encrypted information transmitted from the source IP address to the destination IP address.

[0051] In some embodiments of the present invention, the encrypted network flow is obtained from a network monitoring system according to a preset time window, and includes communication data between at least two network devices.

[0052] The preset time window refers to a fixed period of time set in advance when collecting encrypted network traffic. It can be set to 5 minutes, 1 hour, or other time lengths determined based on actual needs. In actual implementation, the selection of the preset time window can be determined based on the purpose of analysis and the amount of encrypted network traffic to be processed, ensuring that sufficient information is captured without causing excessive data redundancy. This embodiment does not impose any restrictions on the value of the preset time window.

[0053] A network monitoring system refers to a system or tool used to monitor, collect, and analyze encrypted network traffic, such as a network protocol analyzer (Wireshark) or a command-line tool (tcpdump). Network devices refer to various hardware devices that participate in network communications and receive or send encrypted network traffic, including but not limited to routers, switches, servers, personal computers, and mobile devices.

[0054] In actual implementation, the encrypted network stream may also be extracted from a pre-recorded encrypted network stream data set or downloaded from the Internet. This embodiment does not limit the method for obtaining the encrypted network stream.

[0055] In some embodiments of the present invention, the encrypted network flow is split according to five-tuples, wherein the five-tuple includes the source IP address, the destination IP address, the source port, the destination port, and the transport layer protocol.

[0056] Specifically, the encrypted network flow obtained from the network monitoring system based on the preset time window is split into at least one bidirectional network flow, including: splitting the encrypted network flow according to quintuples, identifying different bidirectional network flows and splitting them.

[0057] In actual implementation, the method of splitting the encrypted network flow can also be adjusted according to actual needs. For example, the encrypted network flow can be split into multiple bidirectional network flow information groups according to the quintuple and the location information of the network device, and the location information corresponding to different bidirectional network flow information groups is different; this embodiment does not limit the implementation method of splitting the encrypted network flow into bidirectional network flows.

[0058] Furthermore, because the original encrypted network stream often contains a large amount of redundant information, noise, and unstructured data, it can interfere with subsequent detection. Therefore, before splitting the encrypted network stream into at least one bidirectional network stream, it is necessary to preprocess the encrypted network stream to remove unnecessary parts and retain key information, thereby improving the speed and accuracy of subsequent detection.

[0059] The pre-processing method for the encrypted network flow includes, but is not limited to, data format unification, data cleaning, and outlier processing, etc. This embodiment does not limit the pre-processing method for the encrypted network flow.

[0060] After splitting the encrypted network flow into at least one bidirectional network flow, feature extraction is performed on each bidirectional network flow to obtain network flow features and construct a multi-graph based on the extracted network flow features.

[0061] In some embodiments of the present invention, network flow features include connection information features and interaction information features. Connection information features include source IP address, destination IP address, source port, destination port, and transport layer protocol information; interaction information features include network flow duration, number of upstream packets, number of downstream packets, number of upstream bytes, and number of downstream bytes.

[0062] Step S102 : constructing a multigraph including at least one node pair based on the network flow features corresponding to each bidirectional network flow.

[0063] In the multigraph, each node is constructed by the connection information feature; each pair of nodes is connected by the first-class edge and the second-class edge.

[0064] In traditional encrypted network flow detection methods, each encrypted network flow (for example, all packets from the start to the end of a session) is typically used as a node in a graph to construct a graph. While this method is intuitive, with the growth of the Internet and the popularity of various online services, the number of encrypted network flows has shown an explosive growth trend. In this case, if the graph structure is still constructed with encrypted network flows as nodes, the graph will become extremely large, resulting in the consumption of a large amount of computing and storage resources. At the same time, the large-scale graph structure may also lead to inefficient subsequent encrypted network flow detection, making it difficult to achieve real-time or near-real-time encrypted network flow detection, resulting in poor practicality.

[0065] Therefore, to address the technical issues of excessive resource consumption and low detection efficiency in existing technologies, some embodiments of the present invention construct independent nodes in a multigraph based on the connection information features within network flow features. By focusing on the IP addresses and port numbers of the communicating parties, rather than on the complete encrypted network flow or each individual bidirectional network flow, the number of nodes in the multigraph can be significantly reduced.

[0066] Furthermore, to more effectively and completely represent the complex interaction patterns of encrypted network flows, each node pair is connected by at least two edges, each representing a different interaction pattern or feature, preserving necessary detailed information. This makes the constructed multigraph more concise while still rich in key information. This not only reduces the system burden and improves processing speed, but also enhances the accuracy and practicality of detection, allowing encrypted network flow detection to operate efficiently even with limited resources and support a wider range of application scenarios.

[0067] Specifically, in a multigraph, first-type edges are used to represent different bidirectional network flows between node pairs. The number of first-type edges between any node pair is the same as the number of bidirectional network flows between the node pairs. The edge features of the first-type edges are the mutual information features of the corresponding bidirectional network flows; the edge features of the second-type edges are obtained based on the statistics of all mutual information features between node pairs.

[0068] For example: Reference Figure 2 ; Take node A and node B as columns for explanation; among them, the IP address of node A is 192.168.1.1, the port number is 47231, the IP address of node B is 192.168.1.2, and the port number is 80; there are three bidirectional network flows between node A and node B, namely network flow 1, network flow 2 and network flow 3, so three first-class edges are constructed between node A and node B, representing network flow 1, network flow 2 and network flow 3 respectively, and a second-class edge is used to represent the statistical data of the interaction information characteristics of network flow 1, network flow 2 and network flow 3.

[0069] In some embodiments of the present invention, constructing a multigraph including at least one node pair based on the network flow features corresponding to each bidirectional network flow includes at least the following steps S1021 to S1023:

[0070] Step S1021: Based on the connection information characteristics corresponding to each bidirectional network flow, the number of bidirectional network flows and the number of ports corresponding to each node are determined as node characteristics. The connection information characteristics include source port, destination port, and transport layer protocol information.

[0071] In some embodiments of the present invention, the transport layer protocol information includes TCP protocol and UDP protocol.

[0072] Correspondingly, the bidirectional network flows corresponding to a node include: the TCP network flows sent by the node, the TCP network flows received, the UDP network flows sent, and the UDP network flows received.

[0073] The number of bidirectional network flows includes: the number of TCP network flows sent by the node, the number of TCP network flows received, the number of UDP network flows sent, and the number of UDP network flows received.

[0074] The number of ports includes: the number of ports used for sending TCP network flows, the number of ports used for receiving TCP network flows, the number of ports used for sending UDP network flows, and the number of ports used for receiving UDP network flows.

[0075] Specifically, based on the connection information characteristics corresponding to each bidirectional network flow, the number of bidirectional network flows and the number of ports corresponding to each node are determined as the characteristics of the node, including: identifying and counting all sent TCP network flows and received TCP network flows to obtain the number of sent TCP network flows and the number of received TCP network flows; determining the number of port numbers used for sent TCP network flows and the number of port numbers used for received TCP network flows; identifying and counting all sent UDP network flows and received UDP network flows to obtain the number of sent UDP network flows and the number of received UDP network flows; determining the number of port numbers used for sent UDP network flows and the number of port numbers used for received UDP network flows.

[0076] Step S1022 : Based on the bidirectional network flow between the nodes, first-class edges between the nodes are established, node pairs are constructed, and corresponding edge features are assigned to each first-class edge.

[0077] The first type of edge features include the interactive information characteristics of the corresponding bidirectional network flow, including the network flow duration, the number of upstream packets, the number of downstream packets, the number of upstream bytes, and the number of downstream bytes. These edge features comprehensively describe the specific circumstances of each network flow, providing rich feature support for subsequent analysis and encrypted network flow detection, helping to identify normal communication patterns and potential security threats.

[0078] Step S1023 : constructing a second type of edge between each node pair, and obtaining edge features of the second type of edge through statistical calculation based on the edge features of the first type of edge between the node pairs.

[0079] In some embodiments of the present invention, the edge features of the second type of edges are defined by statistically calculating the edge features (including sum, minimum, maximum, mean, and variance) of all first-type edges between node pairs. This not only preserves the detailed information of individual network flows but also reflects the overall overview of the interactions between node pairs, enabling more comprehensive and in-depth analysis.

[0080] Specifically, based on the edge features of the first-type edges between node pairs, the edge features of the second-type edges are statistically calculated, including: performing statistical calculations on the edge features of all first-type edges between node pairs, including the sum, minimum value, maximum value, mean and variance of each edge feature, to obtain statistical calculation results; and using the statistical calculation results as the edge features of the second-type edges between the corresponding node pairs.

[0081] Step S103 , inputting the multiple graphs into the pre-trained encrypted network flow detection model to obtain the classification detection results of the bidirectional network flow between each node pair.

[0082] Among them, the encrypted network flow detection model includes a relational graph convolutional network (RelationalGCN) encoder and a multilayer perceptron (MLP) classifier.

[0083] The relational graph convolutional network encoder is used to aggregate the edge features corresponding to each node in the multi-graph, update the node representation, concatenate the updated node representation to obtain the interaction relationship representation between the nodes, and input the interaction relationship representation into the multi-layer perceptron classifier.

[0084] like Figure 3As shown in the figure, for each node in the multigraph, features corresponding to the r1 network flow (in), r1 network flow (out), and r2 network flow are extracted. These features reflect the different interaction patterns of the node. The extracted features are transformed (such as linear transformation, convolution, etc.) to obtain intermediate feature representations. The intermediate features are then aggregated (the plus sign in the figure) to obtain a comprehensive node representation. The aggregated features are then subjected to a nonlinear transformation (ReLu activation function) to obtain the final updated node representation.

[0085] After obtaining the updated node representations, the node representations corresponding to each node pair in the multigraph are concatenated to obtain the corresponding interaction relationship representations of the node pairs to capture the interaction patterns between the nodes.

[0086] For example, a node pair is selected from a multigraph, including node A and node B. The updated node of node A is represented as VA, and the updated node of node B is represented as VA. VA and VB are concatenated to form a new vector to represent the interaction relationship between node A and node B.

[0087] After receiving the interaction relationship representation, the multi-layer perceptron classifier is used to classify the interaction relationship representation and obtain the classification detection result of the bidirectional network flow between each node pair.

[0088] In order to enable the above process to be effectively applied to encrypted network flow detection, in some embodiments of the present invention, it is necessary to train a multi-layer perceptron classifier, and combine the trained multi-layer perceptron classifier with a relational graph convolutional network encoder to obtain an encrypted network flow detection model.

[0089] Specifically, the training process of the encrypted network flow detection model includes: obtaining training data; the training data includes: sample interaction relationship representations corresponding to malicious encrypted network flows, sample interaction relationship representations corresponding to benign encrypted network flows, and corresponding true classification labels; inputting the training data into the initial multi-layer perceptron classifier to obtain training results; inputting the training results and true classification labels into the cross-entropy loss function to obtain loss results; using the loss results to iteratively train the initial multi-layer perceptron classifier until the initial multi-layer perceptron classifier converges to obtain a multi-layer perceptron classifier; combining the multi-layer perceptron classifier with a relational graph convolutional network encoder to obtain an encrypted network flow detection model.

[0090] Among them, obtaining training data includes: constructing a sample multigraph based on the sample encrypted network flow; inputting the sample multigraph into the relationship graph convolutional network encoder to obtain the updated node representation corresponding to each node in the sample multigraph; splicing the updated node representation of each node in the sample multigraph to obtain the sample interaction relationship representation, and constructing the training data.

[0091] In actual implementation, the sample encrypted network flow may be extracted from a pre-recorded sample encrypted network flow dataset or downloaded from the Internet. This embodiment does not limit the method for obtaining the sample encrypted network flow.

[0092] In summary, the encrypted network flow detection method based on the improved multigraph provided by this embodiment can solve the problems of large consumption of computing resources and storage resources and poor practicality of existing encrypted network flow detection methods. By constructing independent nodes in the multigraph through the connection information features in the network flow features, the established multigraph can focus on the IP addresses and port numbers of the communicating parties, rather than each individual data packet or complete network flow. In this way, the number of nodes in the graph can be greatly reduced, making the scale of the multigraph much smaller than the scale of the graph with network flows as nodes, reducing the demand for computing resources and storage resources; at the same time, each node pair is connected by at least two edges, each edge representing a different interaction mode or interaction feature, which can retain necessary detailed information, making the constructed multigraph more concise while still rich in key information, achieving the goal of reducing resource requirements and improving processing speed while enhancing the accuracy and practicality of encrypted network flow detection, so that encrypted network flow detection can operate efficiently under limited resources and support larger-scale application scenarios, providing the possibility for real-time monitoring and rapid response to potential security threats, thereby further enhancing network security protection capabilities.

[0093] Corresponding to the above method, the present invention also provides an encrypted network flow detection device based on an improved multigraph, which includes a computer device, the computer device includes a processor and a memory, the memory stores computer instructions, and the processor is used to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the device implements the steps of the encrypted network flow detection method based on the improved multigraph as described above.

[0094] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the aforementioned method for detecting encrypted network flows based on an improved multigraph. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the art.

[0095] An embodiment of the present invention further provides a computer program product, comprising a computer program / instruction, which implements the steps of the aforementioned improved multigraph-based encrypted network flow detection method when executed by a processor.

[0096] It should be understood by those skilled in the art that the various exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is specifically performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present invention are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.

[0097] It should be understood that the present invention is not limited to the specific configurations and processes described above and illustrated in the figures. For the sake of brevity, a detailed description of known methods is omitted. In the above embodiments, several specific steps are described and illustrated as examples. However, the method of the present invention is not limited to the specific steps described and illustrated. Those skilled in the art may make various changes, modifications, and additions, or change the order of the steps after understanding the spirit of the present invention.

[0098] In the present invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or replace features of other embodiments.

[0099] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations to the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A method for detecting encrypted network flows based on improved multigraphs, characterized in that: The method comprises the following steps: Splitting the encrypted network flow obtained from the network monitoring system based on a preset time window into at least one bidirectional network flow, and extracting network flow features corresponding to each bidirectional network flow; the network flow features include connection information features and interaction information features; A multigraph including at least one node pair is constructed based on the network flow features corresponding to each bidirectional network flow; each node is constructed based on the connection information features; each node pair is connected by a first-type edge and a second-type edge, the first-type edge is used to represent different bidirectional network flows between the node pairs, the number of first-type edges between any node pair is the same as the number of bidirectional network flows between the node pairs, the edge features of the first-type edges are the mutual information features of the corresponding bidirectional network flows; the edge features of the second-type edges are obtained based on the statistics of all mutual information features between the node pairs; The multiple graphs are input into a pre-trained encrypted network flow detection model to obtain classification detection results of bidirectional network flows between each node pair; the encrypted network flow detection model includes a relational graph convolutional network encoder and a multi-layer perceptron classifier; the relational graph convolutional network encoder is used to aggregate the edge features corresponding to each node in the multiple graphs, update the node representations, splice the updated node representations to obtain the interaction relationship representations between the nodes, and input the interaction relationship representations into the multi-layer perceptron classifier; the multi-layer perceptron classifier is used to classify the interaction relationship representations to obtain classification detection results of bidirectional network flows between each node pair.

2. The method according to claim 1, characterized in that The connection information features include source IP address, destination IP address, source port, destination port and transport layer protocol information; the interaction information features include network flow duration, number of uplink data packets, number of downlink data packets, number of uplink bytes and number of downlink bytes; The constructing a multigraph including at least one node pair based on the network flow features corresponding to each bidirectional network flow includes: Based on the connection information characteristics corresponding to each bidirectional network flow, the number of network flows and the number of ports corresponding to each node are determined as the characteristics of the node; Establishing first-class edges between nodes based on bidirectional network flows between nodes, constructing node pairs and assigning corresponding edge features to each first-class edge; The second type of edge between each node pair is constructed, and based on the edge features of the first type of edge between the node pairs, the edge features of the second type of edge are statistically calculated.

3. The method according to claim 2, characterized in that The transport layer protocol information includes TCP protocol and UDP protocol; and determining the number of bidirectional network flows and the number of ports corresponding to each node as the node characteristics based on the connection information characteristics corresponding to each bidirectional network flow includes: Identify all sent TCP network flows and received TCP network flows and count them to obtain the number of sent TCP network flows and the number of received TCP network flows; Determine the number of port numbers used for sending TCP network flows and the number of port numbers used for receiving TCP network flows; Identify all sent UDP network flows and received UDP network flows and count them to obtain the number of sent UDP network flows and the number of received UDP network flows; Determines the number of port numbers used for sending UDP network traffic and the number of port numbers used for receiving UDP network traffic.

4. The method according to claim 2, characterized in that The edge features of the second type of edges are obtained by statistically calculating the edge features of the first type of edges between node pairs, including: For all first-class edges between node pairs, the statistical calculation of edge features is performed uniformly, including the sum, minimum, maximum, mean and variance of each edge feature, to obtain the statistical calculation results. The statistical calculation results are used as edge features of the second type of edges between corresponding node pairs.

5. The method according to claim 1, wherein The training process of the encrypted network flow detection model includes: Acquire training data; the training data includes: sample interaction relationship representations corresponding to malicious encrypted network flows, sample interaction relationship representations corresponding to benign encrypted network flows, and corresponding true classification labels; Inputting the training data into an initial multi-layer perceptron classifier to obtain a training result; Inputting the training result and the true classification label into a cross entropy loss function to obtain a loss result; Iteratively training the initial multi-layer perceptron classifier using the loss result until the initial multi-layer perceptron classifier converges to obtain the multi-layer perceptron classifier; The multi-layer perceptron classifier is combined with the relational graph convolutional network encoder to obtain the encrypted network flow detection model.

6. The method according to claim 5, characterized in that The obtaining of training data includes: Construct a sample multigraph based on the sample encrypted network flow; Inputting the sample multigraph into the relational graph convolutional network encoder to obtain an updated node representation corresponding to each node in the sample multigraph; The updated node representations of each node pair in the sample multigraph are concatenated to obtain the sample interaction relationship representation, thereby constructing the training data.

7. The method according to claim 1, characterized in that The step of splitting the encrypted network flow obtained from the network monitoring system based on the preset time window into at least one bidirectional network flow includes: The encrypted network flow is split according to five-tuples, and different bidirectional network flows are identified and split; the five-tuples include source IP address, destination IP address, source port, destination port and transport layer protocol.

8. An encrypted network flow detection device based on an improved multigraph, comprising a processor, a memory, and a computer program / instruction stored in the memory, characterized in that: The processor is configured to execute the computer program / instructions. When the computer program / instructions are executed, the device implements the steps of the method according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images