Malicious traffic detection method based on neighborhood optimization and double-view contrast learning

Abstract

The invention provides a malicious traffic detection method based on neighborhood optimization and double-view contrast learning. Comprising the following steps: step 1, carrying out preprocessing and feature extraction on network traffic data, respectively generating node features in an IP layer and a traffic layer, and constructing a corresponding edge set based on an IP index and traffic similarity; step 2, weighting IP node features based on causal weights, and performing neighborhood aggregation and attention coefficient calculation through a multi-head graph attention network to obtain discriminative node representation fused with causal information; and step 3, fusing the IP layer causal weighted traffic features, the causal feature vectors and the traffic features updated by the graph attention network, mapping the fused features to a category space for classification, calculating the contrast loss of the IP layer and the traffic layer under a multi-view contrast learning framework, and fusing the contrast loss with the cross entropy loss to form total loss. And carrying out malicious traffic detection through back propagation and iterative training optimization model.

Description

Technical Field

[0001] This invention belongs to the field of network traffic detection and relates to a malicious traffic detection method based on neighborhood optimization and dual-view comparison learning. Background Technology

[0002] With the widespread adoption of technologies and applications such as cloud computing, the Internet of Things (IoT), and 5G, network scale and the number of connected devices are growing rapidly, network traffic is increasing exponentially, and network structures are becoming increasingly complex. At the same time, various network attack methods, including distributed denial-of-service attacks, malicious traffic injection, and port scanning, are constantly emerging. Attackers often use techniques such as traffic obfuscation and feature perturbation to disguise malicious behavior as normal access, thereby circumventing traditional detection methods and posing a serious challenge to network security protection.

[0003] To improve the performance of malicious traffic detection, researchers have tried various machine learning and deep learning methods. Traditional machine learning methods (such as support vector machines and decision trees) usually rely on expert experience for manual feature engineering, which is not only costly to extract, but also has limited feature representation capabilities in large-scale, high-dimensional, and dynamically changing network traffic environments, making it difficult to capture complex attack patterns, resulting in insufficient detection accuracy and generalization performance.

[0004] Deep learning-based detection methods (such as convolutional neural networks and recurrent neural networks) automatically learn traffic features through multi-layer nonlinear transformations, overcoming the reliance on manual features to some extent. However, these methods typically treat network traffic as independent feature vectors, ignoring the structural relationships and semantic similarities between traffic flows. For example, multiple sessions initiated by the same attack source may have highly similar features, but independent vector modeling struggles to explicitly utilize these semantic relationships, limiting the model's ability to perceive complex attack chains and covert threats.

[0005] In recent years, Graph Neural Networks (GNNs) have been introduced into the field of network traffic analysis to capture network topology dependencies by aggregating node neighbor information. Most existing GNN-based detection methods construct graph structures based on IP communication relationships (such as source-destination IP pairs), utilizing only network layer connection information (i.e., "who communicates with whom") while ignoring the similarity relationships between application layer features such as traffic payload and protocol behavior. While this method can characterize communication patterns between hosts, it cannot depict semantic relationships at the traffic content level, and its detection effectiveness may significantly decrease against attacks using techniques such as IP spoofing and distributed proxies. On the other hand, if the graph is constructed solely based on traffic feature similarity (i.e., "what traffic is similar"), it lacks utilization of the network topology structure and fails to reflect the propagation path and collaborative behavior of attacks between hosts.

[0006] Therefore, the current field of malicious traffic detection faces the following bottlenecks:

[0007] Limitations of single-view modeling: Most existing methods only model from a single perspective (either topological connections or traffic characteristics), and cannot simultaneously utilize the network's structural information and the semantic information of traffic, resulting in insufficient detection capabilities against complex multi-stage attacks.

[0008] Noise interference in neighborhood aggregation: In graph-based methods, simply aggregating all neighbor features can easily introduce irrelevant or noisy information. How to distinguish the importance of different neighbors and highlight key associations remains an unresolved problem in existing methods.

[0009] Inconsistent feature spaces across multiple views: If topological and semantic views can be constructed simultaneously, there is no mature solution yet for aligning the feature representations of the two views semantically and enhancing the model’s consistency discrimination capability.

[0010] In summary, existing technologies have not yet effectively achieved unified modeling of topological structure and semantic association in both views, nor have they introduced causal weighted neighborhood optimization mechanisms into graph neural networks to suppress noise. Furthermore, they lack cross-view comparative learning to improve feature discriminativeness and robustness. Therefore, there is an urgent need for a malicious traffic detection method that can integrate multi-view information, optimize neighborhood aggregation, and enhance consistency through comparative learning, in order to improve the detection performance against covert and complex attacks. Summary of the Invention

[0011] The purpose of this invention is to more accurately detect malicious traffic in large amounts of network traffic by solving the problems of inconsistent multi-view traffic representation and neighborhood noise interference. To this end, this invention proposes a malicious traffic detection method based on neighborhood optimization and dual-view contrastive learning. First, network traffic data is preprocessed and feature-filtered to handle missing and infinite values, and numerical values ​​are unified and normalized. Then, node features are generated at the IP and traffic layers, and edge sets of the IP and traffic graphs are constructed based on node indices and traffic similarity to form a graph structure representation. Next, causal weights are calculated for IP layer edges, and information is aggregated in the GAT module using weighted neighbor features and multi-head attention to obtain a discriminative node representation with fused causal weights. Finally, multi-view features are fused and mapped to the category space, and contrastive loss is calculated under dual-view contrastive learning and fused with classification cross-entropy loss to form a total loss function. The optimized model is iteratively trained through backpropagation to achieve enhanced feature discriminativeness and view semantic consistency, thereby significantly improving the performance of malicious traffic detection.

[0012] The technical solution of this invention is as follows: a malicious traffic detection method based on neighborhood optimization and dual-view comparison learning is provided, comprising:

[0013] Step 1: Preprocess and extract features from network traffic data, generate node features at the IP layer and traffic layer respectively, and construct corresponding edge sets based on IP index and traffic similarity;

[0014] Step 2: Based on causal weights, the IP node features are weighted and processed. Then, a multi-head graph attention network is used to perform neighborhood aggregation and attention coefficient calculation to obtain a discriminative node representation that integrates causal information.

[0015] Step 3: The causal weighted traffic features of the IP layer, the causal feature vector, and the traffic features updated by the graph attention network are fused and mapped to the category space for classification. At the same time, the contrast loss between the IP layer and the traffic layer is calculated under the multi-view contrastive learning framework, and fused with the cross-entropy loss to form the total loss. The model is optimized through backpropagation and iterative training to detect malicious traffic.

[0016] Firstly, the specific steps of step 1 above are as follows:

[0017] Step 1.1: Use the Pandas library to read the network traffic represented in the original CSV format into memory, skip string features such as FlowID, Source IP, and Destination IP that are not involved in the calculation, and retain the numerical feature column and label column. Detect NaN values ​​and positive / negative infinity values ​​in the dataset and replace them with 0 to avoid information loss. Parse the time feature Timestamp into datetime64 type and convert it into the number of nanoseconds (int64 type) since 1970-01-01 00:00:00 UTC. Convert the remaining features into floating point type and scale them to the [0,1] range using MinMaxScale to reduce the difference in units and improve the model training stability and convergence speed.

[0018] Step 1.2: Traverse all unique IP addresses from the perspective of the IP layer, initialize the feature vector of each IP node, traverse the numerical features of each traffic record and accumulate them into the feature representation of the corresponding source node and target node. At the same time, establish the IP layer edge set according to the node index. After traversing all traffic, normalize the accumulated features of the nodes to obtain the final IP node feature representation.

[0019] Step 1.3: From the perspective of the traffic layer, each network traffic is treated as an independent node. The feature cosine similarity of any two different traffic samples is calculated. The Top-K neighbors with the highest similarity of each traffic node are retained to avoid redundancy in the fully connected computation. Based on this, the traffic layer edge set is constructed, and finally the IP node feature matrix, IP graph edge set, and traffic graph edge set are output.

[0020] Secondly, the specific steps of step 2 above are as follows:

[0021] Step 2.1: Traverse each edge from the perspective of the IP layer to extract the features of the source node and the target node respectively, and apply Dropout to suppress overfitting. Concatenate the features of the source node, the features of the target node and the corresponding traffic features, generate a causal feature vector through a fully connected layer, and project it into a causal weight in the interval [0,1] through linear mapping and Sigmoid activation function.

[0022] Step 2.2: In the Graph Attention Network (GAT) module, iterate through the node features of each layer to obtain the neighbor set of each node. For each neighbor edge, multiply the flow edge feature by the causal weight to obtain the weighted edge feature. Then, concatenate the current node feature, neighbor node features, and weighted edge features and input them into the attention mechanism. After LeakyReLU activation and Softmax normalization, the attention coefficients are obtained and used to sum the neighbor features with weights. Under the multi-head attention mechanism, the outputs of each head are concatenated to form the updated node representation. Finally, the IP node feature matrix with causal weight information is obtained.

[0023] Thirdly, the specific steps of step 3 above are as follows:

[0024] Step 3.1: The IP layer causal weighted traffic features, causal feature vectors, and traffic features updated by GAT are concatenated to form the final traffic feature representation and mapped to the class space through the output layer. The class probability distribution of each traffic is obtained by Softmax normalization.

[0025] Step 3.2: Input the multi-view traffic features into the projection module and map them to the contrast learning space. Construct a positive sample mask matrix to identify the positive sample relationship of each traffic sample. Calculate the similarity matrix from the main view to the auxiliary view and from the auxiliary view to the main view in the IP layer and the traffic layer respectively. Combine the mask to filter the normalized similarity and calculate the bidirectional contrast loss. Then, form the overall contrast loss by weighted summation.

[0026] Step 3.3: The cross-entropy loss of the classification task is fused with the contrast loss of the IP layer and the traffic layer to form the total loss function. Multiple rounds of iterative training are performed through backpropagation and parameter updates to enhance feature discriminativeness and semantic consistency between different views, thereby improving the performance of malicious traffic detection.

[0027] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0028] 1. Traditional single-view methods (such as GNNs based solely on IP communication graphs or GNNs based solely on traffic feature graphs) cannot simultaneously capture the structural dependencies and content semantics of network traffic. This invention models the network from two complementary perspectives: host interaction relationships and traffic behavior characteristics, by constructing an IP layer communication graph and a traffic layer semantic similarity graph. This dual-view design enables the model to simultaneously utilize information about the propagation path of attacks between hosts (topology view) and the behavioral pattern information of the attack traffic itself (semantic view), significantly improving the detection system's comprehensive perception and understanding capabilities in complex network environments.

[0029] 2. In the process of neighborhood information aggregation in graph neural networks, simple averaging or attention mechanisms based on structural connections are prone to introducing interference from irrelevant or noisy neighbors. This invention innovatively proposes a causal edge weight generation module, which dynamically learns the causal importance of the interaction relationship represented by each edge by analyzing the joint information of the source node, target node, and traffic edge features. This weight is used to weighted aggregate neighbor information, enabling the model to focus on key neighbors with strong causal relationships to the current node state during information propagation, effectively suppressing interference from irrelevant or noisy information. This enhances the discriminative power of the final generated node feature vector, making it more reflective of the node's true security status, thereby improving the accuracy and robustness of identifying malicious hosts and abnormal traffic.

[0030] 3. A cross-view contrastive learning mechanism is proposed to enhance the consistency and discriminative power of multi-view feature spaces. This method constructs positive and negative sample pairs in the IP layer view and the traffic layer view, maximizing the similarity of positive samples and minimizing the difference of negative samples. While maintaining feature diversity, it strengthens the expression of semantic association features, effectively improving the accuracy and generalization ability of malicious traffic detection.

[0031] 4. This invention does not simply stack multiple modules, but rather organically combines the standard cross-entropy loss for classification tasks with the bidirectional contrastive loss of the IP and traffic layers through a designed total loss function. This multi-task optimization strategy ensures that the model training process simultaneously aims at "correct classification" and "obtaining consistent high-quality features." Driven by backpropagation, the improved classifier performance promotes the optimization of the feature extractor, while the discriminative features obtained from contrastive learning provide the classifier with higher-quality input, creating a virtuous cycle. (See attached image) Figure 3-7 As shown in the experimental results, this collaborative optimization mechanism enables the MT-NODC model proposed in this invention to significantly outperform existing mainstream methods in multiple core indicators such as accuracy, precision, recall, F1 score and AUC, achieving a comprehensive and effective improvement in the performance of malicious traffic detection. Attached Figure Description

[0032] Figure 1This is an overall flowchart of MT-NODC (Malicious Traffic detection based on Neighborhood optimization and Dual-View Contrastive learning), a malicious traffic detection method based on neighborhood optimization and dual-view contrastive learning.

[0033] Figure 2 This is a detailed flowchart of MT-NODC, a malicious traffic detection method based on neighborhood optimization and dual-view comparative learning.

[0034] Figure 3 These are the accuracy comparison results of the MT-NODC model proposed in this invention on the CIC-UNSW-NB15, BCCC-CIC-IDS2017 and IoT-23 datasets.

[0035] Figure 4 These are the accuracy comparison results of the MT-NODC model proposed in this invention on the CIC-UNSW-NB15, BCCC-CIC-IDS2017 and IoT-23 datasets.

[0036] Figure 5 The results are the recall comparison experiments of the MT-NODC model proposed in this invention on the CIC-UNSW-NB15, BCCC-CIC-IDS2017 and IoT-23 datasets.

[0037] Figure 6 The results are the F1 score comparison experiments of the MT-NODC model proposed in this invention on the CIC-UNSW-NB15, BCCC-CIC-IDS2017 and IoT-23 datasets.

[0038] Figure 7 The results are the AUC values ​​of the MT-NODC model proposed in this invention compared on the CIC-UNSW-NB15, BCCC-CIC-IDS2017 and IoT-23 datasets. Detailed Implementation

[0039] The following is in conjunction with the appendix Figures 1-7 The present invention will be further illustrated by the embodiments described herein. It should be noted that the embodiments described are intended only to facilitate the understanding of the present invention and are not intended to limit it in any way.

[0040] This invention aims to propose a malicious traffic detection method based on neighborhood optimization and dual-view comparative learning for complex network environments, thereby enabling efficient detection of malicious network attacks. The invention provides a comprehensive malicious traffic detection model and conducts thorough experiments to demonstrate the feasibility and effectiveness of the method.

[0041] To verify the effectiveness of the malicious traffic detection method MT-NODC based on neighborhood optimization and dual-view contrastive learning, this invention selected three public network traffic datasets—CIC-UNSW-NB15, BCCC-CIC-IDS2017, and IoT-23—for experimental verification. The experiments were conducted on a 64-bit Linux operating system environment, with the computing platform configured as an Intel® Xeon® Platinum 8168 processor and four NVIDIA A40 graphics processing units. The deep learning framework used was PyTorch, and the Python version was 3.8.

[0042] To reduce the impact of random factors on the experimental results, the random seed was fixed during training, and each experiment was run 30 times independently. The mean and standard deviation of the repeated trials were reported at the end. The model was trained using the Adam optimizer with an initial learning rate of 0.01, a batch size of 128, a Dropout ratio of 0.35, 8 attention heads, a hidden layer dimension of 128, a Top-K value of 5, and a contrastive learning temperature parameter of 0.07. The maximum number of training epochs was set to 200, and an early stopping strategy was adopted, with a patience value of 20 to avoid overfitting.

[0043] The key parameters were all optimized using the validation set and determined after balancing overall performance, stability, and computational cost. Specifically: The Top-K values ​​were compared across candidate ranges (e.g., 3, 5, 7, 10), and K=5 was found to effectively suppress redundant noise while maintaining neighborhood representativeness; the number of attention heads was evaluated under different head configurations to assess the model's representational ability and computational cost, and ultimately 8 heads were selected for superior feature representation and stability; the temperature coefficient τ was determined by comparing the separation and convergence of the contrastive learning distribution at different temperatures, and τ=0.07 showed greater stability in distinguishing positive and negative sample features. These parameters were then uniformly applied to experiments across various datasets to ensure comparability of results.

[0044] like Figure 1 As shown, the present invention proposes a malicious traffic detection method based on neighborhood optimization and dual-view comparison learning, comprising:

[0045] Step 201: Preprocess and extract features from network traffic data, generate node features at the IP layer and traffic layer respectively, and construct corresponding edge sets based on IP index and traffic similarity.

[0046] The purpose of constructing the IP layer and traffic layer graph structure in the embodiments of this invention is to more comprehensively depict the topological relationships and semantic associations of network traffic, thereby providing structured support for subsequent feature fusion and anomaly detection.

[0047] Step 2011: Use the Pandas library to read the network traffic represented in the original CSV format into memory, skip string features such as FlowID, Source IP, and Destination IP that are not involved in the calculation, and retain the numerical feature columns and label columns. Detect NaN values ​​and positive / negative infinity values ​​in the dataset and replace them with 0 to avoid information loss. Parse the time feature Timestamp into datetime64 type and convert it into the number of nanoseconds (int64 type) since 1970-01-01 00:00:00 UTC. Convert the remaining features into floating point type and scale them to the [0,1] range using MinMaxScale to reduce the difference in units and improve the model training stability and convergence speed.

[0048] Step 2012: From the IP layer perspective, traverse all unique IP addresses and initialize the feature vector of each IP node. Traverse the numerical features of each traffic record and accumulate them into the feature representations of the corresponding source and destination nodes. At the same time, build an IP layer edge set based on the node index. After traversing all traffic, normalize the accumulated node features to obtain the final IP node feature representation. The IP layer graph reflecting the communication relationship between hosts is constructed as follows: ;

[0049] Where node v is a unique IP address in the graph, h v Let x be the node feature vector, ε(v) be the set of flow edges connected to node v, and x be the node feature vector. i For the flow edge e connected to node v i The corresponding feature vectors (such as source port number, destination port number, total number of packets, average packet size, connection duration, etc.), h v It is obtained by aggregating the features of all its associated edges and taking the average of the elements.

[0050] Step 2013: From the perspective of the traffic layer, each network traffic is treated as an independent node. The feature cosine similarity of any two different traffic samples is calculated. The Top-K neighbors with the highest similarity for each traffic node are retained to avoid redundancy in the fully connected computation. Based on this, the traffic layer edge set is constructed. Finally, the IP node feature matrix, IP graph edge set, and traffic graph edge set are output. The traffic layer graph reflecting the semantic relationship between traffic is constructed as follows:

[0051] ,

[0052] ;

[0053] Where node v i and v j Let x be the network traffic node i and node j. i and x j These are the corresponding eigenvectors; sim(·) represents the eigenvector x. i With x j The cosine similarity between two networks measures the degree of similarity in the feature space; N i For node v i The set of neighbors, Top-K are those that retain nodes v. i Connect the top K nodes with the highest cosine similarity, E edge For node v i The resulting edge set.

[0054] Step 202: The IP node features are weighted based on causal weights, and neighborhood aggregation and attention coefficient calculation are performed through a multi-head graph attention network to obtain a discriminative node representation that integrates causal information.

[0055] Step 2021: Traverse each edge from the perspective of the IP layer, extract the features of the source node and the target node respectively, and apply Dropout to suppress overfitting. Concatenate the source node features, target node features and corresponding traffic features, generate a causal feature vector through a fully connected layer, and project it into causal weights in the interval [0,1] through linear mapping and Sigmoid activation function.

[0056] The process for generating causal weights, which are used to measure the strength of associations between nodes, is as follows:

[0057] First, the flow characteristics of each edge (i, j) in the IP view are concatenated with the characteristics of its corresponding source node and destination node to form a unified feature vector h. ij : ;

[0058] Among them, e ij Let x be the traffic feature vector of the IP view edge (i, j). i x is the feature vector of the source IP node. j D is the feature vector of the target IP node. p (·) To prevent overfitting, random perturbations are introduced to enhance the robustness of causal inference.

[0059] To generate the causal weights of the edges, the concatenated feature vector h is... ij The input is sequentially fed into a three-layer fully connected network for nonlinear mapping, and then passed through a ReLU activation function to generate a high-dimensional causal feature vector c. ijThen, a linear transformation is applied to map the edge to a scalar space, and the edge causal weight probability p is obtained by normalization using the Sigmoid activation function. ij ;

[0060] ,

[0061] ;

[0062] Where W1, W2, and W3 are the trainable weight matrices for each layer in the three-layer fully connected network, b1, b2, and b3 are the bias terms for each layer, and σ is the sigmoid activation function.

[0063] Step 2022: In the Graph Attention Network (GAT) module, iterate through the node features of each layer to obtain the neighbor set of each node. For each neighbor edge, multiply the flow edge feature by the causal weight to obtain the weighted edge feature. Then, concatenate the current node feature, neighbor node features, and weighted edge features and input them into the attention mechanism. After LeakyReLU activation and Softmax normalization, the attention coefficients are obtained and used to sum the neighbor features with weights. Under the multi-head attention mechanism, the outputs of each head are concatenated to form the updated node representation. Finally, the IP node feature matrix with causal weight information is obtained.

[0064] The node update process for fusing neighbor node features and causal weights is as follows:

[0065] By concatenating the l-th layer feature vectors of the target node i and its neighboring nodes j, along with the causal weighted edge features, the non-normalized attention score of each attention head is calculated. After LeakyReLU activation, the attention head coefficient α is obtained by performing Softmax normalization on all neighboring nodes. ij n,(l) :

[0066] ;

[0067] Among them, W n l Let α be the weight matrix of the nth attention head in the l-th layer. ij n,(l) Let be the coefficient of the nth attention head in the l-th layer, LeakyReLU is a linear rectified function with a small slope used to preserve small gradients for negative inputs, and Softmax is a normalized exponential function.

[0068] To fully integrate neighbor information and enhance the semantics of the graph structure during node feature updates, multiple attention head coefficients are calculated for each neighbor edge in the neighbor set of each node. These coefficients are then used to weight and aggregate neighbor features, and the updated node representation is finally obtained through multi-head concatenation. ;

[0069] Where nheads is the number of attention heads, and hˡᵢ is the node feature of the l-th layer.

[0070] Step 203: The causal weighted traffic features, causal feature vectors, and traffic features updated by GAT of the IP layer are fused and mapped to the category space for classification. At the same time, the contrast loss between the IP layer and the traffic layer is calculated under the multi-view contrastive learning framework and fused with the cross-entropy loss to form the total loss. The model is optimized through backpropagation and iterative training.

[0071] Step 2031: The IP layer causal weighted traffic features, causal feature vectors, and traffic features updated by GAT are concatenated to form the final traffic feature representation. This representation is then mapped to the class space through the output layer. Softmax normalization is used to obtain the class probability distribution for each traffic item. The process of generating the final feature representation for each traffic item and performing classification is shown below:

[0072] ,

[0073] ,

[0074] ;

[0075] Among them, e ij pre For each network traffic edge (i, j) in the IP layer view, the source node feature x i and target node features x j The traffic characteristics obtained by splicing, e ij fc c represents the traffic features obtained by training a graph attention network under the traffic layer view. ij h is the causal feature vector under the IP layer view. ij The final feature representation of the traffic is defined as Out, which is the fully connected linear mapping of the output layer, C is the total number of traffic categories, and p ij pred Let (i, j) be the probability distribution of the final traffic category prediction.

[0076] Step 2032: Input the multi-view traffic features into the projection module and map them to the contrast learning space. Construct a positive sample mask matrix to identify the positive sample relationship of each traffic sample. Calculate the similarity matrix from the main view to the auxiliary view and from the auxiliary view to the main view in the IP layer and the traffic layer, respectively. Combine the mask to filter the normalized similarity and calculate the bidirectional contrast loss. Then, form the overall contrast loss by weighted summation.

[0077] The bidirectional contrastive learning process, used to measure feature consistency among multiple views and improve cross-view discrimination capability, is as follows:

[0078] For the spliced ​​node-type edge feature e ij pre With the original edge-level feature e ij It is mapped to the contrastive learning space using the nonlinear projection function Proj(·):

[0079] ;

[0080] Where Proj(·) is the projection function consisting of two linear transformations and the ELU activation function, z ij mp Let z be the main view feature of the network traffic edge (i, j). ij sc Auxiliary view features for network traffic edge (i, j).

[0081] The projected edge feature z ij mp With z ij sc Input the normalized similarity matrix S from the main view mp to the auxiliary view sc. mp→sc Using the positive sample mask matrix P to compare the similarity matrix S mp→sc To retain the probability contribution of positive sample pairs, the contrast loss from the main view to the auxiliary view and from the auxiliary view to the main view were calculated separately, and the overall contrast loss L was obtained by weighted summation. contrast ;

[0082] ,

[0083] ,

[0084] ;

[0085] Where sim(·) is the cosine similarity between the main view features and the auxiliary view features, τ is the temperature coefficient used to adjust the smoothness of the similarity distribution and the sensitivity of distinguishing positive and negative samples, and L mp→sc Contrast loss from main view to auxiliary view, L sc→mp The comparison loss from the auxiliary view to the main view is represented by N, where N is the number of traffic samples.

[0086] Step 2033: The cross-entropy loss from the classification task is fused with the contrastive losses from the IP layer and the traffic layer to form the total loss function. Multiple rounds of iterative training are then performed through backpropagation and parameter updates to enhance feature discriminative power and semantic consistency between different views, thereby improving malicious traffic detection performance. The loss fusion process is shown below: ;

[0087] Wherein, the classification loss is the cross-entropy loss function, which measures the difference between the predicted probability and the true label, y ij c p is the true label of the traffic sample in category c. ij c To predict the probability that a traffic sample belongs to category c, L contrast IP For the contrast loss of the IP layer view, L contrast flow This represents the contrast loss of the traffic layer view.

[0088] To improve the ability to detect malicious traffic, the training process integrates dual-view contrast loss and classification loss to optimize sample class determination while maintaining consistency of features across different views. This design not only enhances feature discriminativeness but also effectively mitigates learning bias caused by class imbalance or view differences, thereby improving overall detection performance.

[0089] This invention primarily focuses on the accurate identification and efficient detection of malicious network traffic. The effectiveness was tested using three network traffic datasets: CIC-UNSW-NB15, BCCC-CIC-IDS2017, and IoT-23. Figure 3-7 This paper presents a comparison of the detection performance of the proposed method MT-NODC with six other methods (including LightGCN, SGL, MixGCF, SimGCL, XSimGCL, and MuseGNN) in five metrics: accuracy, precision, recall, F1 score, and AUC. The comparison shows that the proposed method can better utilize dual-view features for information complementarity and enhancement, thereby improving the effectiveness of malicious traffic detection.

[0090] To verify the effectiveness of the various improved modules of the malicious traffic detection method MT-NODC based on neighborhood optimization and dual-view comparison learning proposed in this invention, a stepwise ablation experiment design and performance comparison analysis of the improved modules of this invention were carried out, as shown in Table 1.

[0091] Table 1 shows the ablation experimental results of the MT-NODC model proposed in this invention:

[0092] ;

[0093] Wherein GAT represents the basic graph attention neural network model, GAT-DV represents the basic model with the addition of a dual-view decoupling module to simultaneously model the IP communication structure view and the traffic semantic feature view, GAT-CE represents the basic model with the addition of a causal edge weight neighborhood selection module, GAT-CL represents the basic model with the addition of a dual-view contrastive learning detection module, GAT-DV-CE represents the GAT-DV model with the further introduction of a causal edge weight neighborhood selection module, GAT-DV-CL represents the GAT-DV model with the further introduction of a dual-view contrastive learning detection module, and GAT-CE-CL represents the GAT-CE model with the further introduction of a dual-view contrastive learning detection module.

Claims

1. A method for malicious traffic detection based on neighborhood optimization and dual-view contrastive learning, characterized in that, Comprising the following steps: Step 1, preprocessing and feature extraction of network traffic data, generating node features at IP layer and traffic layer respectively and constructing corresponding edge set based on IP index and traffic similarity; the IP layer node features are based on IP address aggregating the feature mean of all associated traffic; The traffic layer edge set is constructed based on cosine similarity selection Top-K neighbor; Step 2, weighting processing of IP node features based on causal weight, neighborhood aggregation and attention coefficient calculation through multi-head graph attention network to obtain discriminative node representation fused with causal information; Step 3, mapping the IP layer causal weighted traffic features, causal feature vectors and traffic features updated by graph attention network to the category space for classification after fusion, and calculating the contrast loss of IP layer and traffic layer under the multi-view contrast learning framework, and then combining with cross entropy loss to form total loss, and optimizing the model through back propagation and iterative training for malicious traffic detection.

2. The method of claim 1, wherein, The specific implementation of step 1 includes the following steps: Step 1.1, read the network traffic represented in original CSV format into memory using Pandas library, skip string features such as Flow ID, Source IP, Destination IP that do not participate in calculation and retain numerical feature columns and label columns, detect NaN values and positive / negative infinity values in the data set and replace them with 0 to avoid information loss, parse the time feature Timestamp to datetime64 type and convert it to nanoseconds since 1970-01-01 00:00:00 UTC, that is, int64 type, and convert the remaining features to float type, and scale them to [0,1] interval through MinMaxScale to reduce dimension difference and improve model training stability and convergence speed; Step 1.2, traverse all unique IP addresses in the IP layer perspective and initialize the feature vector of each IP node, traverse the numerical features of each traffic record and accumulate them into the feature representation of the corresponding source node and target node, and establish the IP layer edge set according to the node index, and after traversing all traffic, normalize the cumulative features of the nodes to obtain the final IP node feature representation; Step 1.3, in the traffic layer perspective, each network traffic is regarded as an independent node, the cosine similarity of the features of any two different traffic samples is calculated, the Top-K neighbors with the highest similarity of each traffic node are retained to avoid full connection calculation redundancy, and the traffic layer edge set is constructed accordingly, finally outputting the IP node feature matrix, IP graph edge set and traffic graph edge set.

3. The method of claim 1, wherein, The specific implementation of step 2 includes the following steps: Step 2.1, traverse each edge in the IP layer perspective to extract the source node and target node features respectively, and apply Dropout to suppress overfitting, concatenate the source node features, target node features and corresponding traffic features, generate causal feature vectors through fully connected layer, and project them to [0,1] interval through linear mapping and Sigmoid activation function to obtain causal weights; Step 2.2, in the graph attention network GAT module, the neighbor set of each node is obtained by iterating the node features of each layer, for each neighbor edge, the flow edge feature is multiplied by the causal weight as the weighted edge feature, then the current node feature, neighbor node feature and weighted edge feature are concatenated to input the attention mechanism, the attention coefficient is obtained by LeakyReLU activation and Softmax normalization, which is used to weight sum the neighbor features, under the multi-head attention mechanism, the outputs of each head are concatenated to form the updated node representation, finally the IP node feature matrix is obtained which fuses the causal weight information.

4. The method of claim 1, wherein, The specific implementation of the step 3 includes the following steps: Step 3.1, the IP layer causal weighted flow feature, the causal feature vector and the flow feature updated by GAT are concatenated to form the final flow feature representation and mapped to the category space through the output layer, and the category probability distribution of each flow is obtained by Softmax normalization; Step 3.2, the multi-view flow feature is input into the projection module to map to the contrast learning space, a positive sample mask matrix is constructed to identify the positive sample relationship of each flow sample, the similarity matrices of the main view to the auxiliary view and the auxiliary view to the main view in the IP layer and the flow layer are calculated respectively, and the bidirectional contrast loss is calculated by combining the mask to filter and normalize the similarity, and then the overall contrast loss is formed by weighted sum; Step 3.3, the cross entropy loss of the classification task and the contrast loss of the IP layer and the flow layer are fused to form the total loss function, and the multi-round iterative training is carried out through back propagation and parameter updating to enhance the feature discriminability and the semantic consistency between different views, so as to improve the performance of malicious flow detection.

Images