Network element association method and system fusing attribute, behavior sequence and topological relation

Abstract

The invention relates to the technical field of telecommunication network security, in particular to a network element association method and system fusing attributes, behavior sequences and topological relations, and the method comprises the steps: carrying out the coarse-grained screening based on network element attributes, constructing the vector representation of the network element attributes, and calculating the similarity of embedded vectors or screening similar network elements in a rule matching mode; performing fine-grained screening on the basis of the network element behavior sequence, modeling the network element behavior sequence by using an attention mechanism, generating low-dimensional vector representation, and further screening candidate network elements according to the similarity of behavior sequence embedded vectors; based on depth map matching of a network element topological relation, constructing topological sub-graphs for interaction generated between the seed network elements and the same batch of users as well as between the candidate network elements and the same batch of users, and calculating the similarity of network element nodes through a graph matching algorithm; and outputting similar network elements obtained by matching. According to the method, a hierarchical progressive matching strategy is adopted, the association detection precision and efficiency of the threat network elements in the telecommunication network are remarkably improved, and attack traceability and security defense are assisted.

Description

Technical Field

[0001] The present invention relates to the technical field of telecommunication network security, and in particular to a network element association method and system integrating attributes, behavior sequences and topological relationships. Background Art

[0002] In recent years, telecommunications networks, as a core component of the global critical information infrastructure (CII), have become a primary target for advanced cyberattacks, facing increasingly diverse and complex threats. The 5G era sees a massive influx of IoT devices, many of which have low power consumption and limited computing and storage resources, making it difficult to deploy complex security policies. Once compromised, these devices can easily form botnets, becoming attack vectors that trigger cyberattacks against user applications and backend systems, leading to security risks such as network outages and system failures. To provide low-latency and more personalized services to customers in vertical industries, 5G networks extend network and computing capabilities to the network edge and user edge. However, these UPF network elements, located further down the network, are closer to the user side, increasing the network's exposure and making them more vulnerable to control and impersonation by attackers. For example, attackers can illegally access or tamper with network element management information to steal user information and disrupt user communication services. Attackers not only have diverse attack methods, but their methods of evading tracking and tracing are also becoming increasingly advanced. Existing monitoring and analysis systems monitor and alert on network element traffic, IP addresses and other attributes, as well as behavioral sequences. However, the monitoring clues are highly fragmented, and cross-domain data is separated, making effective correlation impossible. For example, the session logs of the 5G core network SMF and the data plane alarms of the UPF cannot be correlated in real time, making it difficult to detect abnormal UE (user equipment) behavior across layers. Existing methods for tracing the attack target rely too much on surface attribute information such as IP addresses and domain names, which can be easily bypassed by attackers disguised through TOR networks or cloud services. Therefore, there is an urgent need to monitor network elements in telecommunications networks, build network element correlation methods and systems, discover and correlate non-operator registered assets constructed by attackers, and achieve attack chain tracing and attack scenario restoration. Summary of the Invention

[0003] To effectively correlate the behaviors of network elements carrying out attacks, improve the threat detection capabilities of telecommunications networks, and address the problems of existing monitoring and analysis systems with high fragmentation of monitoring clues, cross-domain data separation, and the inability to effectively correlate, the present invention targets systematic, equipment-based, and large-scale attacks launched by similar attackers such as advanced persistent threat (APT) organizations. This invention proposes a network element correlation method and system that integrates attributes, behavior sequences, and topological relationships to detect similar threat network elements and assist in attack tracing and attack chain restoration.

[0004] In order to achieve the above purpose, the technical solutions adopted are:

[0005] The present invention provides a network element association method integrating attributes, behavior sequences and topological relationships, comprising the following steps:

[0006] Step 1: Perform coarse-grained screening based on network element attributes, construct a vector representation of network element attributes and calculate the similarity of the embedded vectors or use rule matching to screen similar network elements;

[0007] Step 2: Perform fine-grained screening based on the network element behavior sequence. Use the attention mechanism to model the network element behavior sequence, generate a low-dimensional vector representation, and further screen candidate network elements based on the similarity of the behavior sequence embedding vector;

[0008] Step 3: Based on deep graph matching of network element topology relationships, topological subgraphs are constructed for the interactions between seed network elements and candidate network elements and the same group of users, and the similarity of network element nodes is calculated using a graph matching algorithm.

[0009] Step 4: Output the matched similar network elements and aggregate the data of the corresponding network elements.

[0010] According to the network element association method that integrates attributes, behavior sequences and topological relationships of the present invention, further, the vector representation of the network element attributes in step 1 is implemented by one-hot encoding, and the similarity between the seed network element attributes and the network element attributes to be screened is calculated by Jaccard similarity; or the vector representation of the network element attributes is implemented by embedding vectors, and the similarity between the seed network element attributes and the network element attributes to be screened is calculated by cosine similarity.

[0011] According to the network element association method integrating attributes, behavior sequences, and topological relationships of the present invention, further, in step 2, modeling the network element behavior sequence using the attention mechanism specifically includes:

[0012] Define the behavior type as a combination of message type, signaling data type and operation code, and add the behavior type as a category feature to the sequence data;

[0013] Generate embedding vectors of action sequences using self-attention mechanism;

[0014] The similarity between the behavior sequence embedding vector of the candidate network element obtained through coarse-grained screening and the behavior sequence embedding vector of the seed network element is calculated, and the candidate network elements with similarity higher than the threshold are screened out.

[0015] According to the network element association method integrating attributes, behavior sequences, and topological relationships of the present invention, further, the specific implementation of the depth map matching in step 3 includes:

[0016] Construct the interactions between seed network elements, candidate network elements and users into a topology subgraph;

[0017] Define a topological subgraph as a quadruple;

[0018] The graph matching network (GMN) is used to calculate the similarity between graphs and select candidate network elements that are similar to the seed network element.

[0019] According to the network element association method integrating attributes, behavior sequences and topological relationships of the present invention, the topological subgraph is further defined as a quadruple:

[0020] G={P,Q,G,H}

[0021] in, represents the node feature matrix, d p represents the node feature dimension, n represents the total number of nodes; Q∈R dq×m represents the edge feature matrix, d q represents the edge feature dimension, m represents the total number of edges; G represents the edge start point indicator matrix, and H represents the edge end point indicator matrix.

[0022] According to the network element association method integrating attributes, behavior sequences and topological relationships of the present invention, further, the implementation of the graph matching network includes:

[0023] Encode the features of nodes and edges in the graph, and use a multi-layer perceptron to convert node features x i and edge feature x ij Convert to initial hidden representation and e ij ;

[0024] Cross-information propagation is performed between the two graphs to be matched, through the message passing function f message and matching function f match Calculate the messages and matching degree between nodes and update the hidden state of the nodes. At the same time, introduce the attention mechanism to aggregate cross-graph messages and measure node differences.

[0025] Aggregate all updated node vectors into the overall embedding vector of the graph and Compute the embedding vectors of two graphs and If the similarity is greater than the threshold, it is considered to be a similar network element; at the same time, the network element with the highest similarity is the most similar candidate network element.

[0026] According to the network element association method of the present invention that integrates attributes, behavior sequences and topological relationships, further, by minimizing the loss function L pair Optimize graph embedding, the loss function expression is:

[0027]

[0028] Where s(G1, G2) represents the similarity of the embedding vectors of the two graphs, t∈{-1, 1} represents whether they match; E represents the mathematical expectation.

[0029] Furthermore, the present invention also provides a network element association system that integrates attributes, behavior sequences, and topological relationships, for implementing the above-mentioned network element association method that integrates attributes, behavior sequences, and topological relationships. The system includes:

[0030] A coarse-grained screening module based on network element attributes is used to perform coarse-grained screening based on network element attributes, construct a vector representation of network element attributes and calculate the similarity of embedded vectors or use rule matching to screen similar network elements;

[0031] A fine-grained screening module based on network element behavior sequences is used to perform fine-grained screening based on network element behavior sequences. It uses the attention mechanism to model network element behavior sequences, generates low-dimensional vector representations, and further screens candidate network elements based on the similarity of the behavior sequence embedding vectors.

[0032] The graph matching module based on network element topology relationships is used for deep graph matching based on network element topology relationships. It constructs topological subgraphs based on the interactions between seed network elements and candidate network elements and the same group of users, and calculates the similarity of network element nodes through a graph matching algorithm.

[0033] The network element data association and aggregation module is used to output the matched similar network elements and aggregate the data of the corresponding network elements together.

[0034] The beneficial effects achieved by adopting the above technical solution are:

[0035] 1. Improve the accuracy and efficiency of association mapping: This invention adopts a hierarchical progressive strategy, which significantly improves the accuracy and computational efficiency of association mapping through a step-by-step convergence mechanism from coarse-grained matching (based on attributes) to fine-grained matching (based on behavior sequences and topological relationships).

[0036] 2. Extract key patterns in behavior sequences: By constructing interaction behavior sequences between network elements and users, the attention mechanism is used to extract key patterns in the behavior sequences (such as periodic traffic fluctuations and abnormal signaling interactions), and a low-dimensional vector representation is generated to achieve similar network element screening based on behavior patterns.

[0037] 3. Accurately match topology structures: Construct a network element-user interaction topology subgraph, design a deep graph matching model, transform the similarity calculation problem of network element nodes into a graph matching optimization problem, learn the network element topology structure characteristics through message passing within and between graphs, and achieve accurate association mapping.

[0038] 4. Assisted attack tracing and threat detection: It can be used for potential threat detection. It mines similar or homologous threat network elements through seed threat network elements, identifies batch attack resources controlled by attack organizations, and assists in attack chain tracing and attack scenario restoration. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings of the embodiments of the present invention. The drawings are only used to illustrate some embodiments of the present invention, but not to limit all embodiments of the present invention thereto.

[0040] Figure 1 1 is a flow chart of a method for associating network elements by integrating attributes, behavior sequences, and topological relationships according to an embodiment of the present invention;

[0041] Figure 2 This is a structural block diagram of a network element association system that integrates attributes, behavior sequences, and topological relationships according to an embodiment of the present invention. DETAILED DESCRIPTION

[0042] The following will be combined with the accompanying drawings of specific embodiments of the present invention to clearly and completely describe the exemplary embodiments of the present invention. Unless otherwise defined, technical or scientific terms used in the present invention should be given the common meanings understood by people with ordinary skills in the relevant field.

[0043] This embodiment discloses a network element association method that integrates attributes, behavior sequences, and topological relationships. Through network element attributes, behaviors, and topological relationships, it implements step-by-step screening from coarse-grained, fine-grained to precise matching. Through coarse-grained screening of network element attributes, candidate network elements are screened out from massive data, and then the candidate network elements are further identified through the similarity of the vector representation of the network element behavior sequence. Finally, the candidate network element-user topology subgraph is input into the deep graph matching model to achieve precise matching. This solution can be used for potential threat detection. Based on the seed threat network element, similar or homologous threat network elements are found, and batch attack network elements controlled by the attack organization are mined. Seed network elements are usually known network elements that have been confirmed to be malicious or abnormal. For example Figure 1 As shown, the network element entity association mapping method includes the following steps:

[0044] Step S101: Perform coarse-grained screening based on network element attributes, construct a vector representation of the network element attributes and calculate the similarity of the embedded vectors or use rule matching to screen similar network elements.

[0045] First, a quick preliminary screening is performed based on basic attributes such as location. Then, a vector representation of network element attributes is constructed based on other attributes such as the total amount of recent traffic, and the similarity of the embedded vector is calculated or rule matching is used to further screen similar network elements.

[0046] The vector representation of network element attributes can be simply represented by one-hot encoding: first, the numerical attributes are discretized in a unified manner, commonly using equal frequency or equal width discretization; then all network element attributes are converted into dense vectors. Finally, assuming that the total number of different values ​​of all network element attributes is N, the dense vector is converted into an N-dimensional 0-1 encoded sparse vector. As an implementation method, after using this vector representation, Jaccard similarity can be used to measure the similarity of network element attributes. The Jaccard similarity calculation formula between two sets is as follows:

[0047]

[0048] For two n-dimensional 0-1 vectors A and B composed of one-hot encoding, let the number of bits of both vector A and vector B be 1 be M 11 , the number of bits where both vector A and vector B are 0 is M 00 , the number of bits where vector A is 1 and vector B is 0 is M 10 , the number of bits where vector A is 0 and vector B is 1 is M 01 , and M 11 +M 00 +M 10 +M 01 =n, then the Jaccard similarity between vector A and vector B is:

[0049]

[0050] As an implementation option, embedding vectors can be used to represent network element attributes, and the similarity between network element attributes can be calculated using cosine similarity. However, for coarse-grained screening, one-hot encoding is more computationally efficient and more resource-efficient.

[0051] Here are some examples:

[0052] 1. Input: seed network element attribute vector A, set of network element attribute vectors to be screened {B1, B2, ..., B n}.

[0053] 2. Calculation: For each B i Calculate Jaccard(A,B i ).

[0054] 3. Output: filter out Jaccard(A,B i )>threshold B i The corresponding network elements enter fine-grained screening.

[0055] Step S102: Perform fine-grained screening based on the network element behavior sequence, use the attention mechanism to model the network element behavior sequence, generate a low-dimensional vector representation, and further screen candidate network elements based on the similarity of the behavior sequence embedding vector.

[0056] For similar or homologous threat network elements, in attacks targeting the same group of users, a network element behavior sequence (TODO) is generated based on the interactions between the network element and the same group of users. The behavior type action_type is expressed as a combination of message type message_type (divided into request and response), signaling data type data type, and operation code operation_code, i.e. action_type = message_type + data_type + operation_code. The behavior type will be added to the sequence data as a category feature.

[0057] Assume that the seed network element is NE1, and its interactive user set is U1={u1,u2,...,u i ,...,u n}, the candidate network element set E1 obtained after coarse-grained screening is {e1, e2, ..., e i ,...,e n}. Send the seed network element to user u i A single behavior sequence is denoted as A i , then A i It is composed of behavior attribute features (behavior start time start_time, behavior end time end_time, behavior category action_type, etc.). The behavior sequence modeling method can use attention mechanisms such as self-attention to generate an embedding vector for the behavior sequence, and then further screen similar candidate network elements based on the similarity of the behavior sequence embedding vectors.

[0058] The self-attention mechanism is a special attention mechanism that allows the model to consider the relationship between each element in a sequence and all other elements in the sequence when processing it. The self-attention mechanism helps the model better understand the contextual information in the sequence. When used for modeling network element behavior sequences, it can better explore the correlations between individual behaviors in the sequence, thereby obtaining a more accurate vector representation of the sequence.

[0059] Here is an example:

[0060] Enter a network element behavior sequence: [A1(10MB),A2(50MB),A1(5MB),A3(1MB)], where A1 indicates the behavior type is abnormal signaling request, A2 indicates the behavior type is data upload, A3 indicates the behavior type is heartbeat detection, and 10MB, 50MB, 5MB, and 1MB indicate traffic (MB).

[0061] Embedding layer

[0062] Behavior vector: [h1,h2,h3,h4]

[0063] ↓Self-attention

[0064] Weight matrix: α11 = 0.1, α12 = 0.2, α13 = 0.6, α14 = 0.1 # Action 3 (A1) has the highest weight

[0065] ↓Weighted aggregation

[0066] Update vector: h1'=0.1h1+0.2h2+0.6h3+0.1h4

[0067] ↓Sequence aggregation

[0068] Final representation: h_seq = h1'+h2'+h3'+h4'

[0069] Compare the behavior sequence vectors of two network elements (for example, the seed network element NE1 and the candidate network element e1). If the cosine similarity is greater than a set threshold, the behavior patterns of the two are considered similar.

[0070] Step S103: Deep graph matching based on network element topology. After two rounds of screening, the candidate network elements are narrowed down to a smaller range, and then further precise matching is used to obtain the final result. The topological relationship between network elements is of great value in evaluating the similarity of network element nodes. Therefore, the seed network element NE1 and each candidate network element e1, e2, ..., e j ,...,e m Construct a graph for each interaction between the same batch of users, denoted as Therefore, a graph matching algorithm is constructed to solve the problem of finding similar network element nodes.

[0071] First, let’s clarify the definition of a graph. Here, a graph is defined as a quadruple G = {P, Q, G, H}, where represents the node feature matrix, d p represents the node feature dimension, n represents the total number of nodes; Q∈R dq×m represents the edge feature matrix, d q represents the edge feature dimension, m represents the total number of edges; G, H∈{0,1} n×mIt describes the correspondence between nodes and edges, that is, the structure of the graph, where G represents the edge start point indicator matrix and H represents the edge end point indicator matrix.

[0072] Thus, given two graphs G1 = {P1, Q1, G1, H1} and G2 = {P2, Q2, G2, H2}, and defining two incidence matrices and Represents the similarity between nodes and edges in two graphs, for example It describes the similarity between the i1th node in graph G1 and the i2th node in graph G2. It describes the similarity between the c1th edge in the graph G1 and the c2th edge in the graph G2. Therefore, the similarity calculation problem of similar network element nodes is transformed into a graph matching problem. The optimal matching relationship (X1, X2, ..., X m ). For the optimal matching relationship X between two graphs G1 and G2, the sum of the similarity between nodes and the similarity between edges is maximized. The optimization objective function is:

[0073]

[0074] Among them, the first term represents the sum of similarities between matching nodes, and the second term represents the sum of similarities between matching edges. This means that the i1th node in graph G1 matches the i2th node in graph G2.

[0075] Assume that the seed network element NE1 and each candidate network element e1, e2, ..., e j ,...,e m In the figure If both are the first nodes, the seed network element NE1 can be expressed as Each candidate network element can be represented as Then in the final matching relationship (X1, X2, ..., X m ) The nodes are denoted as {e1,e2,...,e i ,...,e k If you want to find the most similar nodes, then in the corresponding association matrix turn up The node e with the largest value is the node most similar to the seed node.

[0076] The steps for constructing the graph matching network (GMN) used are as follows:

[0077] Step 1: (Encoding) Let V be the set of all nodes in the graph and E be the set of all edges. Encode the features of each node and each edge in the graph. The mathematical expression is as follows:

[0078]

[0079] Among them, x i ,x ij Represent the features of nodes and edges respectively. MLP is a fully connected feedforward neural network with an adjustable number of hidden layers. As an implementation method, MLP can be a fully connected neural network with one hidden layer.

[0080] Step 2: (Information propagation) Cross-propagation of information is performed between the two graphs to be matched. In each round, each node matches a similar node in the other graph, and a message is passed between the graphs. The mathematical representation is as follows:

[0081]

[0082] where f message The input vector is concatenated and passed through an MLP layer, f node Typically an MLP layer or a recurrent neural network such as RNN, GRU or LSTM, f s yes and The vector space similarity of is a function that transfers information between two graphs. As an implementation method, an attention-based approach can be used to aggregate the transferred messages:

[0083]

[0084] From this we can get:

[0085]

[0086] Here h Is a similarity function that can be used, such as Euclidean or cosine similarity, a j→i is the attention weight, then Can measure The difference between a node and its most similar node in another graph.

[0087] Step 3: (Aggregation) Aggregate the obtained node representations to form an embedded representation of the entire graph:

[0088]

[0089] After determining the network structure, we give the loss function of the entire GMN model as follows:

[0090]

[0091] Here t∈{-1,1} indicates whether it matches. You can choose Euler distance. When there are many candidate graphs, in order to improve the matching efficiency, you can use binary vectors to represent the graphs, that is, h G ∈{-1,1} H After being converted into a binary vector, we can use efficient vector nearest neighbor search algorithms such as simhash to find the nearest neighbor of h. G When it is positive, minimize the Hamming distance. G By adding this restriction, it is not necessary to operate in the entire Euclidean space, thus achieving fast retrieval and indexing. G By transforming through the tanh function, we get the following loss function:

[0092]

[0093] in, It is an approximate Hamming distance. Using a nonlinear function like tanh is more stable during training than using the Hamming distance directly, and it can prevent the gradient from falling too fast. By minimizing the loss function L pair , the graph matching model will continuously adjust the graph embedding h during the training process G , so that the graph embeddings corresponding to the two mismatched graphs become more and more different. Finally, by comparing the similarity of the embedding vectors of the entire graph, the graph that is most similar to the input graph in topology can be obtained.

[0094] Step S104: output the matched similar network elements, and aggregate the data of the corresponding network elements.

[0095] Corresponding to the above method, this embodiment also discloses a network element association system that integrates attributes, behavior sequences and topological relationships, such as Figure 2 As shown, the system includes:

[0096] A coarse-grained screening module based on network element attributes is used to perform coarse-grained screening based on network element attributes, construct a vector representation of network element attributes and calculate the similarity of embedded vectors or use rule matching to screen similar network elements;

[0097] A fine-grained screening module based on network element behavior sequences is used to perform fine-grained screening based on network element behavior sequences. It uses the attention mechanism to model network element behavior sequences, generates low-dimensional vector representations, and further screens candidate network elements based on the similarity of the behavior sequence embedding vectors.

[0098] The graph matching module based on network element topology relationships is used for deep graph matching based on network element topology relationships. It constructs topological subgraphs based on the interactions between seed network elements and candidate network elements and the same group of users, and calculates the similarity of network element nodes through a graph matching algorithm.

[0099] The network element data association and aggregation module is used to output similar network elements obtained through matching and aggregate the data of corresponding network elements together. Based on the associated data, it provides clues for attack source and organization analysis.

[0100] It should be noted that the network element association system that integrates attributes, behavior sequences and topological relationships provided in the embodiment of the present invention is for the purpose of implementing the above method embodiment. Its specific functions can be referred to the above method embodiment and will not be repeated here.

[0101] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0102] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0103] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0104] Those skilled in the art will appreciate that all or part of the steps in the above method can be performed by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps in the above embodiment can be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or software functional modules. The present invention is not limited to any specific combination of hardware and software.

[0105] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-described embodiments within the technical scope disclosed by the present invention, or replace some of the technical features therein with equivalents. Such modifications, changes, or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A network element association method integrating attributes, behavior sequences and topological relationships, characterized in that: The following steps are involved: Step 1: Perform coarse-grained screening based on network element attributes, construct a vector representation of network element attributes and calculate the similarity of the embedded vectors or use rule matching to screen similar network elements; Step 2: Perform fine-grained screening based on the network element behavior sequence. Use the attention mechanism to model the network element behavior sequence, generate a low-dimensional vector representation, and further screen candidate network elements based on the similarity of the behavior sequence embedding vector; Step 3: Based on deep graph matching of network element topology relationships, topological subgraphs are constructed for the interactions between seed network elements and candidate network elements and the same group of users, and the similarity of network element nodes is calculated using a graph matching algorithm. Step 4: Output the matched similar network elements and aggregate the data of the corresponding network elements.

2. The network element association method integrating attributes, behavior sequences and topological relationships according to claim 1 is characterized in that: In step 1, the vector representation of the network element attributes is implemented using one-hot encoding, and the similarity between the seed network element attributes and the network element attributes to be screened is calculated using Jaccard similarity; or the vector representation of the network element attributes is implemented using embedded vectors, and the similarity between the seed network element attributes and the network element attributes to be screened is calculated using cosine similarity.

3. The network element association method integrating attributes, behavior sequences and topological relationships according to claim 1 is characterized in that: In step 2, the attention mechanism is used to model the network element behavior sequence, specifically including: Define the behavior type as a combination of message type, signaling data type and operation code, and add the behavior type as a category feature to the sequence data; Generate embedding vectors of action sequences using self-attention mechanism; The similarity between the behavior sequence embedding vector of the candidate network element obtained through coarse-grained screening and the behavior sequence embedding vector of the seed network element is calculated, and the candidate network elements with similarity higher than the threshold are screened out.

4. The network element association method integrating attributes, behavior sequences and topological relationships according to claim 1, characterized in that: The specific implementation of depth map matching in step 3 includes: Construct the interactions between seed network elements, candidate network elements and users into a topology subgraph; Define a topological subgraph as a quadruple; The graph matching network (GMN) is used to calculate the similarity between graphs and select candidate network elements that are similar to the seed network element.

5. The network element association method integrating attributes, behavior sequences and topological relationships according to claim 4 is characterized in that: The topological subgraph is defined as a quadruple: G={P,Q,G,H} in, represents the node feature matrix, d p represents the node feature dimension, n represents the total number of nodes; Q∈R dq×m represents the edge feature matrix, d q represents the edge feature dimension, m represents the total number of edges; G represents the edge start point indicator matrix, and H represents the edge end point indicator matrix.

6. The network element association method integrating attributes, behavior sequences and topological relationships according to claim 4, characterized in that: The implementation of the graph matching network includes: Encode the features of nodes and edges in the graph, and use a multi-layer perceptron to convert node features x i and edge feature x ij Convert to initial hidden representation and e ij ; Cross-information propagation is performed between the two graphs to be matched, through the message passing function f message and matching function f match Calculate the messages and matching degree between nodes and update the hidden state of the nodes. At the same time, introduce the attention mechanism to aggregate cross-graph messages and measure node differences. Aggregate all updated node vectors into the overall embedding vector of the graph and Compute the embedding vectors of two graphs and If the similarity is greater than the threshold, it is considered to be a similar network element; at the same time, the network element with the highest similarity is the most similar candidate network element.

7. The network element association method integrating attributes, behavior sequences and topological relationships according to claim 6, characterized in that: By minimizing the loss function L pair Optimize graph embedding, the loss function expression is: Where s(G1, G2) represents the similarity of the embedding vectors of the two graphs, t∈{-1, 1} represents whether they match; E represents the mathematical expectation.

8. A network element association system integrating attributes, behavior sequences and topological relationships, characterized in that: A method for associating network elements according to any one of claims 1 to 7, wherein the system comprises: A coarse-grained screening module based on network element attributes is used to perform coarse-grained screening based on network element attributes, construct a vector representation of network element attributes and calculate the similarity of embedded vectors or use rule matching to screen similar network elements; A fine-grained screening module based on network element behavior sequences is used to perform fine-grained screening based on network element behavior sequences. It uses the attention mechanism to model network element behavior sequences, generates low-dimensional vector representations, and further screens candidate network elements based on the similarity of the behavior sequence embedding vectors. The graph matching module based on network element topology relationships is used for deep graph matching based on network element topology relationships. It constructs topological subgraphs based on the interactions between seed network elements and candidate network elements and the same group of users, and calculates the similarity of network element nodes through a graph matching algorithm. The network element data association and aggregation module is used to output the matched similar network elements and aggregate the data of the corresponding network elements together.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory, wherein: The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images