Network traffic deep packet detection and malicious behavior identification system

Abstract

The invention discloses a network traffic deep packet detection and malicious behavior recognition system, which relates to the technical field of network security, and comprises a traffic feature multi-dimensional extraction module, a dynamic graph construction and updating module, an adaptive graph attention recognition module and a closed loop feedback optimization module. A network communication relation is modeled into a dynamic graph structure, a graph neural network based on a dynamic attention mechanism is adopted to identify malicious behaviors such as botnet, transverse movement and data leakage, system parameters are continuously optimized through a closed-loop feedback mechanism, and the four modules form a deep coupling closed-loop cooperative system. According to the method, the mutual promotion and superposition synergistic effect is achieved, the system malicious behavior recognition accuracy rate reaches 96% or above, the processing delay is controlled at the microsecond level, and the method can be applied to network security protection of operator networks and large enterprises.

Description

Network traffic deep packet inspection and malicious behavior identification system Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network traffic deep packet inspection and malicious behavior identification system. Background Technology

[0002] As cyberattack methods continue to evolve, traditional signature- and rule-based intrusion detection systems are struggling to cope with complex cyber threats. New attack patterns such as botnets, advanced persistent threats (APPTs), and lateral movement attacks are characterized by high stealth, complex attack chains, and long durations, posing a severe challenge to network security. Deep packet inspection (DPI) technology, by analyzing the complete content of network data packets, can identify malicious behavior in network traffic and is a crucial means of detecting cyber threats.

[0003] CN118337485A discloses a network information security analysis method and system based on big data. The system extracts abnormal activity connection addresses from firewall log data and monitors abnormal behavior data to obtain abnormal behavior monitoring data. It then captures and processes abnormal behavior traffic from the abnormal behavior monitoring data and performs threat behavior situational awareness to obtain threat behavior situational awareness data. Based on the threat behavior situational awareness data, it performs attack behavior structure logic analysis to obtain attack behavior structure logic data. Finally, based on the attack behavior structure logic data, it designs a big data attack sniffing engine and performs automated firmware design to obtain automated firmware for big data attack sniffing.

[0004] However, the aforementioned existing technologies have the following shortcomings: First, in terms of traffic feature extraction, they only extract features from the statistical and protocol levels, lacking in-depth mining of payload content and temporal patterns, resulting in insufficient detection capabilities for covert attacks. Second, in terms of malicious behavior identification, the Policy Gradient algorithm and Gradient Boosting Tree algorithm used are mainly based on feature learning from a single traffic sample, failing to fully utilize the correlation between network nodes and topological information, thus having limited detection effectiveness for complex attack patterns such as botnets and lateral movement that require a global network view for identification. Third, in terms of system optimization, the lack of a closed-loop feedback mechanism makes it impossible to dynamically adjust system parameters based on detection results, leading to poor adaptability to constantly changing attack methods. Fourth, in terms of real-time processing capabilities, the real-time analysis and detection capabilities in high-throughput network environments are insufficient, making it difficult to meet the actual needs of operator networks and large enterprises.

[0005] Therefore, how to construct a high-performance network traffic deep packet inspection and malicious behavior identification system that can fully explore the multi-dimensional characteristics of network traffic, perform global analysis using network topology relationships, and has closed-loop adaptive optimization capabilities has become a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] In view of the problems existing in the prior art, the purpose of this invention is to provide a network traffic deep packet inspection and malicious behavior identification system. By constructing four deeply coupled core modules, namely, multi-dimensional extraction of traffic features, dynamic graph construction and updating, adaptive graph attention identification, and closed-loop feedback optimization, the system can achieve comprehensive analysis of network traffic and accurate identification of malicious behavior, thus solving the problems of insufficient feature extraction, weak correlation analysis capability, lack of adaptive optimization mechanism, and insufficient real-time processing capability in the prior art.

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] This network traffic deep packet inspection and malicious behavior identification system comprises a multi-dimensional traffic feature extraction module, a dynamic graph construction and update module, an adaptive graph attention identification module, and a closed-loop feedback optimization module. The multi-dimensional traffic feature extraction module performs deep packet inspection on network traffic, extracting statistical, protocol, payload, and temporal features to generate traffic feature vectors. The dynamic graph construction and update module constructs a network communication graph based on these traffic feature vectors. This graph uses network nodes as vertices, communication connections as edges, and traffic feature vectors as node attributes, dynamically updating the topology and node attributes of the network communication graph according to temporal changes in network traffic. The adaptive graph attention identification module performs feature aggregation and propagation on the network communication graph based on an improved graph attention network, calculating dynamic attention weights between nodes. These dynamic attention weights are adaptively adjusted based on the topology change rate and node feature similarity of the network communication graph, identifying malicious behavior patterns such as botnets, lateral movement, data breaches, and advanced persistent threats, and outputting malicious behavior identification results and confidence scores. The closed-loop feedback optimization module evaluates the system's detection performance based on the malicious behavior identification results and confidence scores. When the confidence score is lower than the preset threshold or a false alarm is detected, it generates parameter adjustment instructions and feeds these instructions back to the traffic feature multidimensional extraction module, the dynamic graph construction and update module, and the adaptive graph attention recognition module. These instructions adjust the feature extraction weights, graph update rate, and attention weight calculation parameters, thus forming a closed-loop optimization mechanism.

[0009] This invention achieves the following beneficial effects by constructing four deeply coupled core modules: First, the multi-dimensional traffic feature extraction module comprehensively extracts network traffic features from four dimensions: statistics, protocol, load, and time series. Compared with existing technologies that only extract statistical and protocol features, this significantly improves the completeness and richness of feature representation, enabling more effective characterization of the behavioral patterns of covert attacks. Second, the dynamic graph construction and update module models network communication relationships as a graph structure and updates the graph's topology and node attributes in real time. This allows the system to analyze the relationships between nodes from a global network view, significantly enhancing the detection capability for complex attack patterns such as botnets and lateral movement compared to existing technologies that analyze based on a single traffic sample. Third, the adaptive graph attention recognition module dynamically adjusts attention weights, enabling the system to adapt to changes in network topology. Compared with existing technologies that use fixed-weight machine learning algorithms, this significantly improves the adaptability to constantly evolving attack methods and the accuracy of recognition. Fourth, the closed-loop feedback optimization module dynamically adjusts the parameters of the front-end modules based on the detection results, forming a deep coupling and closed-loop feedback mechanism at the parameter and state levels. This enables continuous optimization of system performance and significantly improves long-term stability and accuracy compared to existing static systems lacking feedback mechanisms. Fifth, the deep coupling and closed-loop collaboration among the four modules generate a synergistic effect of mutual promotion and additive enhancement, resulting in non-linear growth in the overall system detection performance. The accuracy rate for identifying malicious behavior reaches over 96%, and the processing latency is controlled at the microsecond level, representing a qualitative leap compared to existing technologies. Attached Figure Description

[0010] Figure 1 is a schematic diagram of the overall structure of the network traffic deep packet inspection and malicious behavior identification system of the present invention.

[0011] Figure 2 is a schematic diagram of the internal structure of the multi-dimensional extraction module for flow characteristics of the present invention.

[0012] Figure 3 is a schematic diagram of the workflow of the dynamic graph construction and update module of the present invention.

[0013] Figure 4 is a schematic diagram of the adaptive graph attention recognition module of the present invention.

[0014] Figure 5 is a schematic diagram of the dynamic attention weight calculation process of the present invention.

[0015] Figure 6 is a schematic diagram of the working principle of the closed-loop feedback optimization module of the present invention.

[0016] Figure 7 is a schematic diagram of the overall workflow of the system of the present invention. Detailed Implementation

[0017] Please refer to Figures 1-7. To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0018] Referring to Figure 1, the network traffic deep packet inspection and malicious behavior identification system provided by this invention includes a traffic feature multidimensional extraction module 1, a dynamic graph construction and update module 2, an adaptive graph attention recognition module 3, and a closed-loop feedback optimization module 4. These four modules form a deeply coupled closed-loop collaborative system. The output of the traffic feature multidimensional extraction module 1 serves as the input of the dynamic graph construction and update module 2, the output of the dynamic graph construction and update module 2 serves as the input of the adaptive graph attention recognition module 3, and the output of the adaptive graph attention recognition module 3 serves as the input of the closed-loop feedback optimization module 4. The output of the closed-loop feedback optimization module 4 adjusts the parameters of the traffic feature multidimensional extraction module 1, the dynamic graph construction and update module 2, and the adaptive graph attention recognition module 3 in reverse, forming a complete closed-loop feedback mechanism.

[0019] Referring to Figure 2, the multi-dimensional traffic feature extraction module 1 is used to perform deep packet inspection on network traffic, comprehensively extracting network traffic features from multiple dimensions. This module includes a statistical feature extraction unit, a protocol feature extraction unit, a payload feature extraction unit, and a time-series feature extraction unit.

[0020] The statistical feature extraction unit performs statistical analysis on network traffic, extracting packet size distribution characteristics, traffic rate characteristics, connection duration characteristics, and burstiness indicators. Packet size distribution characteristics include the mean, variance, maximum, and minimum packet lengths. Traffic rate characteristics include uplink traffic rate, downlink traffic rate, and bidirectional traffic rate. Connection duration characteristics represent the duration of a network connection. The burstiness indicator measures the degree of traffic burstiness by calculating the coefficient of variation of traffic within a time window. Preferably, the time window is set to three scales: 1s, 5s, and 10s, to extract short-term, medium-term, and long-term burstiness characteristics, respectively.

[0021] Preferably, the statistical feature extraction unit further extracts the skewness and kurtosis of the packet size distribution as higher-order statistical features. Skewness measures the asymmetry of the packet size distribution, and kurtosis measures the kurtosis of the packet size distribution. For packets containing... A traffic sequence of data packets, with a packet size of [number]. skewness The calculation formula is:

[0022] ,

[0023] in, This represents the average size of the data packets. Kurtosis The calculation formula is:

[0024] ,

[0025] Skewness and kurtosis can capture subtle differences in the packet size distribution between normal and malicious traffic. Normal traffic typically has a skewness close to 0 and a kurtosis close to 0, while some malicious traffic (such as DDoS attacks) may have a skewness significantly deviating from 0 and a kurtosis significantly greater than 0.

[0026] The protocol feature extraction unit performs protocol parsing on network traffic, extracting transport layer protocol features and application layer protocol features. Transport layer protocol features include TCP flag status, UDP port number distribution, and ICMP type codes. Application layer protocol features include HTTP request methods, DNS query types, TLS handshake parameters, and FTP command sequences. Protocol behavior patterns are extracted by analyzing protocol interaction sequences, such as the HTTP request-response pattern and the DNS query-response pattern.

[0027] The payload feature extraction unit performs deep inspection of the network packet payload content, extracting payload byte distribution features and payload entropy values. The payload byte distribution features are represented by statistically analyzing the frequency of each byte value in the payload, forming a 256-dimensional byte distribution vector. The payload entropy value measures the randomness of the payload by calculating the Shannon entropy of the payload content; encrypted traffic typically has a higher entropy value, while plaintext traffic has a lower entropy value. Preferably, for encrypted traffic, plaintext features from the TLS handshake phase are further extracted, including server name indication, certificate chain length, and cipher suite selection.

[0028] Preferably, the load feature extraction unit further extracts the N-gram pattern of the load bytes. The N-gram pattern represents the continuous load bytes. The combination pattern of bytes can capture the local structural features of the payload content. Specifically, for the payload byte sequence ,extract The N-gram pattern. The 3-gram pattern includes all combinations of three consecutive bytes. The 4-gram pattern includes all combinations of four consecutive bytes. The 5-gram pattern includes all combinations of 5 consecutive bytes. For each N-gram pattern, its frequency of occurrence in the payload is counted to form an N-gram frequency vector. To control the feature dimensions, all N-gram patterns are sorted by frequency of occurrence, and the top 100 high-frequency patterns are selected as features. N-gram patterns can effectively identify specific byte combination patterns in malicious payloads, such as shellcode features and encrypted traffic features.

[0029] The time-series feature extraction unit extracts the time-series features of network traffic, including packet arrival time interval sequences and traffic time-series fluctuation patterns. The packet arrival time interval sequence records the time intervals between consecutive packets, forming a time series. The traffic time-series fluctuation pattern is extracted by analyzing the time series of traffic rates, using a sliding time window to calculate the time-series statistical features of the traffic rate, including mean, variance, skewness, and kurtosis. Preferably, the sliding window size is set to 10 seconds, and the step size is set to 1 second to capture the dynamic changes in traffic.

[0030] Preferably, the time-series feature extraction unit further extracts the autocorrelation function and power spectral density of the data packet arrival time interval sequence. The autocorrelation function is used to measure the correlation of the time series under different time delays and can reveal the periodic pattern of traffic. For the time interval sequence... lag autocorrelation function The calculation formula is:

[0031] ,

[0032] in, This represents the average of the time intervals. Preferably, the lag is calculated. The autocorrelation function values ​​are used to form a 10-dimensional autocorrelation eigenvector. The power spectral density is obtained by performing a Fast Fourier Transform (FFT) on the time interval sequence, representing the energy distribution of the time series at different frequency components. The calculation formula is:

[0033] ,

[0034] in, For frequency, The imaginary unit is used. Preferably, for the frequency range... By uniformly sampling 20 frequency points, a 20-dimensional power spectral density eigenvector is obtained. The maximum frequency is set to half the sampling rate. The autocorrelation function and power spectral density can capture the temporal periodicity and frequency domain characteristics of traffic, which helps to identify malicious behaviors with specific temporal patterns (such as heartbeat communication, timed scanning, etc.).

[0035] The features extracted from the four units are concatenated and normalized to generate a unified traffic feature vector. Preferably, the statistical feature dimension is 64 dimensions, the protocol feature dimension is 128 dimensions, the payload feature dimension is 256 dimensions, the time series feature dimension is 128 dimensions, and the final traffic feature vector dimension is 576 dimensions.

[0036] Preferably, the dynamic graph construction and update module 2 uses the matrix product state (MPS) representation of tensor networks to compress the structure of the network communication graph. Traditional adjacency matrix representations, for networks containing... A graph with 1 node needs Storage space, when the network size is large (e.g. The storage overhead is huge. Matrix product state representation compresses the graph structure into the product of multiple local tensors through tensor decomposition, significantly reducing storage complexity.

[0037] Specifically, the adjacency matrix of the network communication graph It can be represented in the form of a matrix product:

[0038] ,

[0039] in, For the first The local tensor corresponding to each node For nodes The state index, This is the bond dimension. The boundary conditions are... The storage complexity of the matrix product state representation is O(n). ,in This represents the maximum key dimension. When selecting... At that time, the storage complexity is from Reduce to .

[0040] Key Dimension Adaptively adjusts based on network size. When the number of network nodes... When, set ;when When, set ;when When, set The adaptive adjustment strategy ensures effective graph structure compression while keeping computational complexity within an acceptable range.

[0041] The update of the matrix product state representation employs a variational optimization method. When the topology of the network communication graph changes (edges are added or deleted), the corresponding tensor is updated locally. and This eliminates the need to recalculate the entire matrix product state representation. The optimization objective of local updates is to minimize the reconstruction error:

[0042] ,

[0043] in, The updated target adjacency matrix, The adjacency matrix is ​​the reconstructed state of the matrix product. It is the Frobenius norm. Optimization is achieved through the Alternating Least Squares (ALS) algorithm, iteratively updating... and Until convergence. Preferably, the maximum number of iterations for the ALS algorithm is set to 10, and the convergence threshold is set to... .

[0044] Matrix product state representation achieves significant compression of storage space while preserving graph structure information. For graphs containing... For large-scale networks with a number of nodes, a traditional adjacency matrix requires approximately [number missing]. The storage unit (requiring 4TB of storage space based on 32-bit floating-point calculations), while the matrix multiplication state representation ( Only about The storage unit (approximately 6.4GB of storage space) achieves a compression ratio of 625 times. This compression enables the system to process large-scale network traffic data with limited hardware resources, significantly improving the system's scalability.

[0045] Referring to Figure 3, the dynamic graph construction and update module 2 is used to construct a network communication graph based on traffic feature vectors, and dynamically update the graph's topology and node attributes according to the temporal changes in network traffic. This module includes an initial graph construction unit, a topology change detection unit, a node attribute update unit, and an edge weight calculation unit.

[0046] The initial graph construction unit builds the initial topology of the network communication graph when the system starts. The network communication graph is defined as follows: ,in Represents a set of nodes. Denotes the set of edges. Represents the node feature matrix. Node set. Each node in the set corresponds to a network IP address, and the edge set Each edge in Represents a node With nodes There are communication connections between them. Node feature matrix Store the traffic feature vector for each node, where Indicates the number of nodes. This represents the dimension of the feature vector. Preferably, for node pairs without communication connections, edges are not created in the graph to reduce the sparsity of the graph.

[0047] The topology change detection unit monitors changes in the network communication graph's topology in real time. When a new communication connection is detected, a corresponding edge is added to the graph; when a connection is broken, the corresponding edge is deleted from the graph. (Topology change rate) Defined in the time window The degree of change in the internal graph structure is measured by the graph edit distance. Specifically, it records the time. The graph structure is ,time The graph structure is The topological change rate is the sum of the number of edges added and deleted, divided by the total number of edges. Preferably, the time window... The time limit is set to 60 seconds. When the rate of topological change exceeds 0.1, the graph structure is considered to have changed significantly.

[0048] The node attribute update unit updates the node's feature vector based on the newly arriving network traffic. For a node... Its eigenvectors The new feature vector is updated using an exponentially weighted moving average method. From the current feature vector and newly extracted feature vectors The weighted combination is obtained, and the weight coefficient is determined according to the freshness of the traffic. Preferably, the weight coefficient is set to 0.3, that is, new features account for 30% and historical features account for 70%, so as to maintain the stability and timeliness of the features.

[0049] The edge weight calculation unit calculates the weight of each edge based on the communication frequency and traffic volume. For each edge... Its weight Taking into account communication frequency and flow rate This is obtained through weighted summation. Communication frequency. Indicates the node within the statistical time window With nodes Number of communications between them. Traffic volume. Indicates the node within the statistical time window With nodes The amount of data transmitted between them. Preferably, the weight of communication frequency is set to 0.6, the weight of traffic volume is set to 0.4, and the statistical time window is set to 300s.

[0050] The output of the dynamic graph construction and update module 2 is a network communication graph that is updated in real time. ,in This represents the edge weight matrix. This network communication graph serves as the input to the adaptive graph attention recognition module 3.

[0051] Referring to Figure 4, the adaptive graph attention recognition module 3 is used to perform feature aggregation and propagation on the network communication graph based on an improved graph attention network to identify malicious behavior patterns. This module includes a graph convolutional feature aggregation unit, a dynamic attention calculation unit, a feature propagation unit, and a malicious pattern matching unit.

[0052] The graph convolution feature aggregation unit performs graph convolution operations on the network communication graph, aggregating the features of each node's neighboring nodes. For each node... Its set of neighboring nodes is denoted as Features after aggregation By node Its own characteristics The graph convolution operation is composed of a weighted sum of features from neighboring nodes. A multi-layer structure is used, preferably three layers. The first layer extracts primary features from the original features, while the second and third layers progressively aggregate higher-order neighborhood information.

[0053] The dynamic attention calculation unit is one of the core innovations of this invention. Traditional graph attention networks use a fixed attention mechanism, which cannot adapt to dynamic changes in network topology. The dynamic attention mechanism proposed in this invention adaptively adjusts the attention weights based on the rate of change of the network communication graph and the similarity of node features, enabling the system to respond more sensitively to changes in network state.

[0054] Referring to Figure 5, the calculation process of dynamic attention weights is as follows:

[0055] First, node feature similarity is calculated as the initial attention coefficient. For nodes... and its neighboring nodes Node feature similarity We obtain the following by calculating the cosine similarity of the feature vectors:

[0056] ,

[0057] in, For nodes eigenvectors, For nodes eigenvectors, express transpose, express The L2 norm.

[0058] Then, the initial attention coefficients are calculated using a shared attention mechanism. :

[0059] ,

[0060] in, This is the weight matrix. For attention vectors, This indicates a feature concatenation operation. This is the activation function.

[0061] Next, based on the topology change rate of the network communication graph Generate dynamic adjustment factor :

[0062] ,

[0063] in, These are adjustment coefficients used to control the degree to which topological changes affect the attention weights. Preferably, A value of 2.0 ensures that the system pays more attention to newly emerging connections when the topology change rate is high.

[0064] Finally, the initial attention coefficients With dynamic adjustment factor Multiply the results and normalize them using softmax to obtain the dynamic attention weights. :

[0065] ,

[0066] in, Represents an exponential function. Represents a node The set of neighboring nodes, This represents summing the results over neighboring nodes.

[0067] Dynamic attention weights By comprehensively considering node feature similarity and network topology changes, the system can improve its sensitivity to new connections when the topology changes drastically, and rely more on historically learned attention patterns when the topology is stable. This adaptive mechanism significantly enhances the system's ability to adapt to evolving attack methods.

[0068] The feature propagation unit propagates feature information in the network communication graph based on dynamic attention weights. Node The Layer features We obtain the following by weighted aggregation of the features of neighboring nodes:

[0069] ,

[0070] in, For the activation function, the ELU activation function is preferred. For the first The weight matrix of the layer, Neighboring nodes The Layer features. To enhance the model's expressive power, a multi-head attention mechanism is employed, repeatedly performing attention calculations. Next, then to The outputs are concatenated or averaged. Preferably, the number of heads... Set it to 8.

[0071] The malicious pattern matching unit matches the characteristics of propagated nodes against a pre-defined malicious behavior pattern library to identify the type of malicious behavior. The malicious behavior pattern library includes botnet patterns, lateral movement patterns, data breach patterns, and advanced persistent threat (APS) patterns. Botnet patterns are characterized by multiple nodes communicating simultaneously with the same control server, and the communication traffic exhibits periodicity. Lateral movement patterns are characterized by nodes establishing connections with multiple internal nodes within a short period, and the connection ports being abnormal. Data breach patterns are characterized by nodes sending large amounts of data externally, and the traffic lasting for a long period. APS patterns are characterized by long-term latency, low-frequency communication, and multi-stage attacks.

[0072] Pattern matching employs a graph convolutional neural network-based classifier. Node features are input into the classifier, which outputs a probability distribution of malicious behavior types. The classifier uses a softmax layer as its output. The probability of each category, where This represents the number of malicious behavior types. Preferably, The threshold is set to 5, encompassing normal traffic, botnets, lateral movement, data breaches, and advanced persistent threats. The confidence score is defined as the highest probability value; when the confidence score exceeds a preset threshold, the node is considered to be engaging in malicious behavior. Preferably, the threshold is set to 0.85.

[0073] Preferably, the parameter optimization of the adaptive graph attention recognition module 3 employs the information geometry method. The information geometry method treats the parameter space as a Riemannian manifold, defines a metric structure on the manifold, and utilizes natural gradient descent for optimization. Compared to traditional Euclidean gradient descent, natural gradient descent considers the geometric structure of the parameter space, enabling it to find the optimal parameters more efficiently.

[0074] Specifically, let the parameters of the adaptive graph attention recognition module 3 be... ,in This is the weight matrix. For attention vectors, To adjust the coefficients. The metric structure in the parameter space is determined by the Fisher information matrix. Definition. Elements of the Fisher information matrix. The calculation formula is:

[0075] ,

[0076] in, For given parameters Time observation data The probability distribution, and parameter vector The The and the first One portion, It represents the expectation of the observed data. The Fisher information matrix is ​​a positive definite symmetric matrix that defines a Riemannian metric in the parameter space.

[0077] The parameter update rule for natural gradient descent is:

[0078] ,

[0079] in, For the first The parameter values ​​for the next iteration. For learning rate, This is the inverse of the Fisher information matrix. loss function Regarding parameters The gradient of the natural gradient. The direction of the fastest decrease in the loss function is pointed on the Riemannian manifold, taking into account the local geometry of the parameter space.

[0080] Preferably, the learning rate An adaptive adjustment strategy is adopted. The initial learning rate is set to... The loss function is dynamically adjusted during training based on changes in the loss function. When the loss function decreases by less than [a certain value] in five consecutive iterations... When the learning rate decreases, it is halved; when the loss function increases, the learning rate is reduced to 0.2 times its original value, and the parameters are rolled back to the value of the previous iteration. The adaptive learning rate strategy can accelerate convergence in the early stages of training and fine-tune parameters in the later stages, improving model performance.

[0081] The Fisher information matrix is ​​calculated using a sampling estimation method. Random samples are taken from current network traffic data. Sample The estimated value of the Fisher information matrix is:

[0082] ,

[0083] Preferably, the number of samples Setting it to 1000 ensures both estimation accuracy and computational cost control. To avoid instability in the inverse calculation of the Fisher information matrix, a regularization method is used to correct the Fisher information matrix. , in It is the identity matrix. The regularization coefficient is preferably set to a value of 1. .

[0084] Compared to traditional Euclidean gradient descent, the information geometry optimization method offers a shorter optimization path and faster convergence speed on Riemannian manifolds. Experiments show that the model training convergence speed using natural gradient descent is approximately 40% faster than standard gradient descent, and the final model performance (measured by detection accuracy) is improved by approximately 3-5 percentage points. The information geometry optimization method fully utilizes the geometric structure information of the parameter space, enabling the adaptive graph attention recognition module 3 to learn the optimal attention allocation strategy more efficiently.

[0085] The adaptive graph attention recognition module 3 outputs the malicious behavior recognition result and confidence score, which serves as the input to the closed-loop feedback optimization module 4.

[0086] Referring to Figure 6, the closed-loop feedback optimization module 4 is used to evaluate the system's detection performance based on the malicious behavior identification results and confidence scores, and generate parameter adjustment instructions to feed back to the front-end module, forming a closed-loop optimization mechanism. This module includes a performance evaluation unit, a parameter optimization strategy generation unit, and a feedback scheduling unit.

[0087] The performance evaluation unit assesses the system's detection accuracy, recall, and false positive rate based on the malicious behavior identification results. Detection accuracy is defined as the ratio of correctly identified malicious traffic to the total number of detected traffic. Recall is defined as the ratio of correctly identified malicious traffic to the actual number of malicious traffic. False positive rate is defined as the ratio of falsely reported normal traffic to the actual number of normal traffic. A confusion matrix is ​​calculated by comparing the results with the actual labels, and then the various performance metrics are calculated. Preferably, performance evaluation is performed every 10 minutes.

[0088] When the confidence score is detected to be below a preset threshold or the false alarm rate exceeds a preset upper limit, the parameter optimization process is triggered. A low confidence score indicates that the model's judgment of the current traffic is not certain enough, and there may be unknown attack patterns. An excessive false alarm rate indicates that the model is misjudging normal traffic too often, and the model parameters need to be adjusted to reduce false alarms. Preferably, the confidence threshold is set to 0.75, and the upper limit of the false alarm rate is set to 5%.

[0089] The parameter optimization strategy generation unit generates targeted parameter adjustment instructions based on performance evaluation results. When the recall rate is low, the weight of temporal features in the traffic feature multidimensional extraction module 1 is increased to enhance the detection capability against covert attacks. When the false positive rate is high, the coefficient of the dynamic adjustment factor in the adaptive graph attention recognition module 3 is decreased. This reduces sensitivity to topology changes. When the topology change rate remains high, the graph update rate of the dynamic graph construction and update module 2 is increased to shorten the update cycle. Parameter adjustment adopts the gradient descent approach, determining the adjustment direction and magnitude based on the partial derivatives of performance indicators. Preferably, the magnitude of a single adjustment does not exceed 10% of the current parameter value to ensure system stability.

[0090] The feedback scheduling unit distributes parameter adjustment instructions to the traffic feature multidimensional extraction module 1, the dynamic graph construction and update module 2, and the adaptive graph attention recognition module 3. For the traffic feature multidimensional extraction module 1, the weight coefficients of various features are adjusted, affecting the composition of the final traffic feature vector. For the dynamic graph construction and update module 2, the graph update cycle and the weight coefficients for edge weight calculation are adjusted. For the adaptive graph attention recognition module 3, the coefficients of the dynamic adjustment factor are adjusted. And confidence threshold. After parameter adjustment, the system continues to run, and the performance evaluation unit continuously monitors changes in performance indicators, forming a closed-loop iterative optimization.

[0091] Through the closed-loop feedback optimization module 4, the system can dynamically adjust the parameters of each module according to the actual operating conditions, achieving adaptive optimization. This closed-loop mechanism ensures that there is not only forward data flow and feature transfer between the four modules, but also reverse parameter adjustment and state update, forming a deeply coupled closed-loop collaborative system.

[0092] Referring to Figure 7, the overall workflow of the system of the present invention is as follows:

[0093] The first step is to perform deep packet inspection on the real-time collected network traffic using the multi-dimensional traffic feature extraction module 1, which extracts traffic features from four dimensions: statistics, protocol, payload, and time series, generating a 576-dimensional traffic feature vector.

[0094] The second step involves the dynamic graph construction and update module 2, which constructs and updates the network communication graph based on traffic feature vectors. The initial graph construction unit establishes the initial graph structure upon system startup, the topology change detection unit monitors real-time topology changes and calculates the topology change rate, the node attribute update unit updates node features based on new traffic, and the edge weight calculation unit calculates the edge weight values.

[0095] The third step involves the adaptive graph attention recognition module 3 analyzing and recognizing the network communication graph. The graph convolutional feature aggregation unit performs multi-layer convolution operations on the graph, the dynamic attention calculation unit calculates dynamic attention weights based on the topology change rate and node feature similarity, the feature propagation unit propagates features based on the attention weights, and the malicious pattern matching unit matches the final features with the malicious behavior pattern library, outputting the malicious behavior recognition result and confidence score.

[0096] The fourth step involves the closed-loop feedback optimization module 4 evaluating system performance and generating parameter adjustment instructions. The performance evaluation unit calculates the detection accuracy, recall, and false alarm rate; the parameter optimization strategy generation unit generates adjustment strategies based on the performance indicators; and the feedback scheduling unit distributes the adjustment instructions to the three preceding modules to adjust the corresponding parameters.

[0097] Fifth, the system repeats the above steps in a loop, forming a continuous cycle of traffic detection, behavior recognition, and parameter optimization.

[0098] The core innovation of this invention lies in the deep coupling and closed-loop collaborative mechanism among the four modules, specifically reflected in the following three aspects:

[0099] The output traffic feature vector of the multidimensional traffic feature extraction module 1 is directly used as the node attribute of the dynamic graph construction and update module 2. The output network communication graph and its topology change rate of the dynamic graph construction and update module 2 are directly used as the input of the adaptive graph attention recognition module 3. The output confidence score of the adaptive graph attention recognition module 3 is directly used as the judgment basis of the closed-loop feedback optimization module 4. The inputs and outputs of the four modules form a strict dependency relationship, and the output quality of the previous module directly affects the performance of the next module.

[0100] The closed-loop feedback optimization module 4 not only receives the output of the adaptive graph attention recognition module 3, but also transmits parameter adjustment instructions back to the first three modules, adjusting the internal state and parameter configuration of each module. This reverse feedback forms a complete closed loop of forward transmission → performance evaluation → reverse feedback → parameter adjustment, enabling the system to optimize the preceding process based on the output results and achieve end-to-end overall optimization.

[0101] The synergy of the four modules produces the following effects: First, a mutually reinforcing effect: the richer the traffic features, the stronger the expressive power of the network communication graph, the higher the accuracy of graph attention recognition, and the better the feedback optimization effect, thereby promoting the optimization of traffic feature extraction. Second, a synergistic effect: each module can only solve part of the problem when working alone, but when the four modules work together, they can form a complete link from feature extraction, graph modeling, attention recognition to closed-loop optimization, resulting in a non-linear increase in overall performance. Third, an adaptive adjustment effect: through the closed-loop feedback mechanism, the system can adapt to changes in network conditions and attack patterns, continuously maintaining high performance.

[0102] In one specific embodiment, the system of the present invention is deployed in bypass mode on the core router of a certain operator's backbone network to monitor all traffic entering and leaving the backbone network. The network environment has a bandwidth of 10Gbps, an average traffic rate of 8Gbps, a peak traffic rate of 9.5Gbps, and approximately 12 million data packets per second.

[0103] The multi-dimensional traffic feature extraction module 1 employs a multi-threaded parallel processing architecture, using 16 threads to perform feature extraction simultaneously, achieving a throughput of 15 million packets per second. The burstiness indicators extracted by the statistical feature extraction unit effectively identify the traffic characteristics of DDoS attacks. The TLS handshake parameters extracted by the protocol feature extraction unit identify self-signed certificates used by malware. The payload entropy values ​​extracted by the payload feature extraction unit identify encrypted C&C communication. The traffic temporal fluctuation patterns extracted by the time-series feature extraction unit identify the periodic communication of botnets.

[0104] The network communication graph constructed by the dynamic graph construction and update module 2 contains approximately 500,000 nodes and 2 million edges, with a graph update cycle of 60 seconds. When a large-scale scanning attack is detected, the topology change rate increases from 0.05 to 0.32 within 5 minutes, triggering the fast graph update mechanism. The edge weight calculation unit assigns weights to edges based on communication frequency and traffic volume; high-weight edges correspond to frequently communicating node pairs and receive higher attention in subsequent graph attention calculations.

[0105] The adaptive graph attention recognition module 3 employs a 3-layer graph attention network, with 8 attention heads per layer, resulting in approximately 5 million network parameters. The dynamic attention weight calculation unit automatically increases the dynamic adjustment factor when the topology change rate is high, making the system more sensitive to newly emerging connections and successfully identifying a lateral movement attack. After breaching an internal network host, the attacker scanned and attempted to connect to multiple internal network targets within a short period, causing rapid changes in the network communication graph topology. Traditional fixed attention mechanisms respond slowly to such rapid changes, while the dynamic attention mechanism of this invention quickly captures abnormal connection patterns and marks the involved nodes as high-risk.

[0106] The closed-loop feedback optimization module 4 performed 12 parameter adjustments during the first three days of system operation, primarily adjusting the weights of temporal features and the dynamic adjustment factor. After optimization, the system's malicious behavior identification accuracy improved from 92.3% to 96.7%, the recall rate increased from 89.5% to 94.2%, and the false positive rate decreased from 7.8% to 3.1%. The processing latency remained within 5μs, meeting the requirements for real-time detection.

[0107] The system of this invention also includes a real-time stream processing engine, a threat intelligence fusion module, and a visualization analysis module. These three modules are respectively responsible for the real-time collection and distribution of traffic data, the fusion of external threat intelligence, and the visualization of detection results, thereby improving the overall performance and availability of the system.

[0108] The real-time stream processing engine is connected to the traffic feature multi-dimensional extraction module 1, and is used to collect, buffer, and distribute network traffic in real time, providing stable data input for the traffic feature multi-dimensional extraction module 1. The engine includes a packet capture unit, a traffic buffering unit, and a data distribution unit.

[0109] The packet capture unit is responsible for capturing raw data packets from the network interface in real time. This unit employs zero-copy technology, directly mapping the data packets received by the network interface card to user space memory, avoiding the overhead of data copying from kernel mode to user mode and significantly reducing processing latency. Preferably, the packet capture unit uses DPDK (Data Plane Development Kit) or PF_RING technology to achieve high-performance packet capture, supporting a capture rate of tens of millions of packets per second. Specifically, in a 10Gbps network environment, the packet capture unit can capture packets with an average length of 1500 bytes without packet loss, corresponding to a packet rate of approximately 8.33 million packets / second; in a 40Gbps network environment, it can capture approximately 33 million packets / second.

[0110] The traffic buffer unit buffers captured data packets, smoothing out instantaneous fluctuations in traffic rate. This unit employs a ring buffer structure, with the buffer size adaptively adjusted according to network traffic characteristics. When the network traffic rate is lower than the processing capacity, the buffer remains small (e.g., 100MB) to reduce memory overhead; when the network traffic rate approaches or exceeds the processing capacity, the buffer automatically expands (up to a maximum of 2GB) to avoid data packet loss. The ring buffer uses a lock-free data structure, supporting concurrent writing by multiple capture threads and concurrent reading by multiple processing threads, avoiding synchronization overhead between threads. Preferably, the ring buffer has 65,536 slots, each capable of holding a data packet of the maximum transmission unit (MTU) size, with a default value of 9,000 bytes (supporting jumbo frames).

[0111] The data distribution unit distributes buffered data packets to multiple processing threads of the traffic feature multi-dimensional extraction module 1 according to a predetermined strategy. This unit employs a flow hash distribution strategy, calculating a hash value based on the five-tuple of the data packet (source IP address, destination IP address, source port, destination port, and protocol type), and distributing data packets belonging to the same flow to the same processing thread, ensuring the processing order of data packets within the flow. The flow hash function uses either CRC32 or Toeplitz hash algorithms, which are fast and produce a uniform distribution of hash values. The data distribution unit supports dynamic load balancing, adjusting the data packet allocation ratio according to the load of each processing thread. When the queue length of a processing thread exceeds a threshold (preferably set to 1000 data packets), the data distribution unit prioritizes allocating subsequent data packets to threads with lower loads, preventing a single thread from becoming a bottleneck.

[0112] The real-time stream processing engine employs a multi-threaded parallel processing architecture, where packet capture, buffering, and distribution are executed concurrently in different threads. Preferably, the number of packet capture threads is set to the number of network interface card queues, typically 4 to 16; a separate management thread monitors the buffer status for traffic buffering; and the number of data distribution threads matches the number of processing threads in the traffic feature multi-dimensional extraction module 1, typically 8 to 32. This multi-threaded architecture fully utilizes the parallel computing power of multi-core processors to achieve high throughput and low latency traffic processing. In one specific embodiment, the real-time stream processing engine is deployed on a server equipped with dual Intel Xeon Gold 6248R processors (20 cores and 40 threads per processor), achieving a packet processing throughput of 15 million packets per second in actual tests, with processing latency remaining within 5 microseconds.

[0113] The threat intelligence fusion module is connected to the adaptive graph attention recognition module 3 to obtain the latest malicious behavior characteristics from external threat intelligence sources, update the malicious behavior pattern library, and improve the system's ability to identify new attacks and unknown threats. This module includes an intelligence source access unit, an intelligence parsing unit, an intelligence verification unit, and a pattern library update unit.

[0114] The intelligence source access unit is responsible for acquiring threat intelligence data from various external threat intelligence sources. Supported threat intelligence source types include STIX / TAXII standard intelligence sources, open threat intelligence platforms (such as AlienVault OTX, VirusTotal, AbuseIPDB), commercial threat intelligence services (such as Recorded Future, ThreatConnect), and industry-shared threat intelligence (such as the Financial Industry Information Sharing and Analysis Center FS-ISAC). This unit adopts a standardized intelligence access protocol, supporting HTTPS RESTful API, STIX 2.0 / 2.1 format, and CSV / JSON format intelligence data. Preferably, the intelligence source access unit automatically pulls intelligence updates once per hour, and for intelligence sources marked as high priority (such as intelligence on known APT group activities), it can be set to pull every 15 minutes.

[0115] The intelligence analysis unit parses and standardizes the acquired threat intelligence data. This unit extracts key elements from the intelligence, including threat type (malware, botnets, phishing attacks, DDoS attacks, etc.), threat indicators (IP address, domain name, URL, file hash value, network behavior characteristics, etc.), confidence score, severity, first discovery time, and last active time. Data formats from different intelligence sources may differ; the intelligence analysis unit converts them into a unified internal representation format. For STIX format intelligence, it extracts the Indicator object, Attack Pattern object, and Relationship object; for CSV format intelligence, it parses it according to predefined field mapping relationships. Preferably, the internal representation format is JSON, containing fields such as threat_type, indicators, confidence_score, severity_level, first_seen, and last_seen.

[0116] The intelligence verification unit verifies and deduplicates the parsed threat intelligence, filtering out low-quality and duplicate intelligence data. This unit first checks the completeness of the intelligence, filtering out intelligence lacking key fields (such as threat indicators and confidence scores); then it checks the timeliness of the intelligence, filtering out expired intelligence (e.g., intelligence whose last active time was more than 90 days ago); next, it performs deduplication, retaining the intelligence with the highest confidence score from different sources but describing the same threat, and weighting and merging the confidence scores of other intelligence; finally, it performs false positive verification, comparing the intelligence indicators with a known whitelist (such as internal server IP addresses and legitimate domain names) to filter out false positives. Preferably, the intelligence verification unit sets a confidence threshold of 0.6; intelligence below this threshold is marked as low-confidence intelligence and used only for reference, not directly for detection.

[0117] The pattern library update unit converts verified threat intelligence into malicious behavior patterns and updates the malicious behavior pattern library in the adaptive graph attention recognition module 3. This unit generates corresponding graph pattern features based on the network behavior characteristics in the threat intelligence. For example, for botnet intelligence, it extracts the C&C server IP address and the communication patterns of the controlled host to generate a graph pattern in which multiple nodes simultaneously initiate connections to the same external node; for lateral movement attack intelligence, it extracts the attacker's scanning and exploitation behavior characteristics to generate a graph pattern in which a single node connects to multiple internal nodes in a short period. The pattern library update uses an incremental update method; newly added malicious behavior patterns are appended to the pattern library, and the source intelligence ID and update time are recorded for each pattern. Preferably, the pattern library has a capacity limit of 100,000 patterns. When the number of patterns reaches the limit, the oldest added pattern that has not been matched is automatically deleted to maintain the timeliness of the pattern library.

[0118] The threat intelligence fusion module continuously acquires and integrates external threat intelligence, enabling the system to respond quickly to emerging threats. When an APT group launches a new type of attack, the security community typically releases relevant threat intelligence within hours to days. The threat intelligence fusion module can complete the entire process of intelligence acquisition, parsing, verification, and pattern library updates within one hour of intelligence release, giving the system the ability to detect this new type of attack. This rapid response capability significantly shortens the system's detection blind spot and compensates for the lag in response to unknown threats by traditional detection models trained on historical data. In one specific embodiment, the threat intelligence fusion module acquires approximately 5,000 new pieces of intelligence daily from 15 threat intelligence sources. After verification and deduplication, it adds an average of 200 high-quality patterns to the malicious behavior pattern library daily.

[0119] The visualization analysis module connects with the adaptive graph attention recognition module 3 and the dynamic graph construction and update module 2 to visualize network communication graphs and malicious behavior identification results, providing security analysts with an intuitive interface for situational awareness and threat analysis. This module includes a graph rendering unit, an interactive analysis unit, and a report generation unit.

[0120] The graph rendering unit is responsible for visually rendering the network communication graph generated by the dynamic graph construction and update module 2. This unit uses a force-directed layout algorithm to calculate the spatial positions of nodes, ensuring that connected nodes are close together and unconnected nodes are far apart, forming an intuitive topology display. Node size is mapped to their degree (number of connecting edges); nodes with higher degrees (e.g., gateways, servers) are displayed larger. Node color is mapped to their risk score, using a gradient color scheme from green (low risk) to yellow (medium risk) to red (high risk). Edge thickness is mapped to edge weights; edges with higher weights (indicating higher communication frequency or greater traffic) are displayed thicker. Edge color is differentiated by communication direction: outgoing traffic is displayed in blue, and incoming traffic in orange. Preferably, the graph rendering unit uses WebGL technology for GPU-accelerated rendering, enabling smooth display of large-scale network communication graphs containing 100,000 nodes and 500,000 edges, maintaining a frame rate above 30fps.

[0121] The graph rendering unit also supports switching between multiple visualization views. The global view displays the topology of the entire network communication graph, suitable for macro-level situational awareness; the local view displays an N-hop neighbor subgraph centered on a certain node (preferably N is set to 2 or 3), suitable for in-depth analysis of the communication behavior of specific nodes; the time-series view displays the evolution of the network communication graph over time, and the graph state at historical moments can be replayed through the time axis control component, suitable for analyzing the temporal evolution of attacks; the heatmap view maps the topology of the network communication graph to a two-dimensional heatmap, with the horizontal and vertical axes representing the source and destination nodes respectively, and the heat value representing the communication intensity, suitable for quickly identifying abnormal communication patterns.

[0122] The interactive analysis unit provides security analysts with a wealth of interactive functions. This unit supports viewing details by clicking on nodes; clicking on a node brings up a details panel displaying the node's IP address, MAC address, hostname, operating system type, open ports, historical communication records, risk score, and its calculation basis. It also supports viewing traffic details by clicking on edges; clicking on an edge displays the connection's five-tuple information, communication time range, total traffic volume, number of data packets, and application layer protocol type. Node search and location are supported; entering an IP address or hostname quickly locates and highlights the corresponding node. Graph structure filtering is supported, allowing filtering of displayed nodes and edges based on node type (internal host, external host, server, gateway, etc.), risk level, time range, and other criteria. Topology export is also supported, allowing the currently displayed network communication graph to be exported as a PNG image, SVG vector graphic, or GEXF graph data format for easy sharing and further analysis.

[0123] The interactive analysis unit also integrates path tracing functionality. When malicious behavior is detected, security analysts can select a starting node (e.g., the victim host) and an ending node (e.g., the C&C server). The system automatically calculates and highlights the shortest path or all possible paths between the two nodes, helping analysts understand the attack's propagation chain and intermediate hops. Path calculation is implemented using Breadth-First Search (BFS) or Dijkstra's algorithm, with a computational time complexity of O(log n). or ,in For the number of nodes, The number of edges is specified. For a graph containing 500,000 nodes and 2 million edges, the path calculation time is controlled within 100 milliseconds to achieve real-time response.

[0124] The report generation unit automatically generates security incident reports and statistical analysis reports based on the malicious behavior identification results of the adaptive graph attention recognition module 3. The security incident reports generate detailed event descriptions for each detected malicious behavior, including event type (botnet, lateral movement, data breach, APT attack, etc.), occurrence time, involved source and destination nodes, traffic characteristics, matched malicious behavior patterns, confidence score, and recommended remedial measures. Preferably, the security incident reports are generated in PDF or HTML format, including charts and tables for easy reading and archiving.

[0125] Statistical analysis reports analyze detection results over a period of time (e.g., the past 24 hours, past 7 days, past 30 days), generating statistical charts such as attack trend analysis, attack source distribution, attack type distribution, and high-risk node rankings. Attack trend analysis plots curves showing the number of attack events over time, identifying peak attack periods; attack source distribution statistically analyzes the geographical distribution of attack source IP addresses, creating a world map heatmap; attack type distribution statistically analyzes the proportion of different attack types, creating pie charts or bar charts; and the high-risk node ranking is based on node risk scores, listing the top 20 nodes with the highest risk scores, highlighting assets requiring special attention. These statistical analysis reports help security managers grasp the cybersecurity landscape from a macro perspective and develop targeted protection strategies.

[0126] The visualization analysis module significantly improves the efficiency of security analysts through its intuitive graphical interface and rich interactive functions. Traditional log- and alarm-based analysis methods require analysts to search for correlations in large amounts of text information, which is time-consuming and prone to omissions. In contrast, the visualization analysis module presents network communication relationships and detection results graphically, making complex attack chains and correlations clear at a glance. Analysts can quickly locate the attack source, trace the attack path, and assess the scope of impact, reducing the analysis time from an average of 30 minutes to less than 5 minutes. In one specific embodiment, security analysts successfully traced the complete attack chain of an APT attack using the visualization analysis module, from the initial breach point to the lateral movement path and the data leakage channel, with the entire analysis process taking only 8 minutes.

[0127] The real-time stream processing engine provides high-throughput, low-latency data input to the traffic feature multi-dimensional extraction module 1, ensuring the system can handle large-scale network traffic without packet loss. The threat intelligence fusion module provides the adaptive graph attention recognition module 3 with the latest malicious behavior patterns, ensuring the system can detect emerging threats in a timely manner. The visualization analysis module provides security analysts with an intuitive analysis interface, visually displaying the graph structure of the dynamic graph construction and update module 2 and the detection results of the adaptive graph attention recognition module 3, assisting in human decision-making and response. These three auxiliary modules, together with the four core modules, constitute a complete end-to-end deep packet inspection and malicious behavior recognition solution, covering the entire process from data collection, feature extraction, graph modeling, behavior recognition, closed-loop optimization to intelligence fusion and visualization analysis.

[0128] During a 30-day continuous operation test, the system of this invention successfully detected and blocked 15 botnet attacks, 8 lateral movement attacks, 6 data breach attempts, and 3 advanced persistent threats, with no missed detections. Compared with other deployed intrusion detection systems, the system of this invention has a 12% higher detection accuracy, a 60% lower false positive rate, and a 75% lower detection latency.

[0129] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A network traffic deep packet inspection and malicious behavior identification system, characterized in that, include: The traffic feature multidimensional extraction module is used to perform deep packet inspection on network traffic, extract the statistical features, protocol features, payload features and time series features of the network traffic, and generate a traffic feature vector. The dynamic graph construction and update module is connected to the traffic feature multidimensional extraction module. It is used to construct a network communication graph based on the traffic feature vector. The network communication graph has network nodes as vertices, communication connections as edges, and the traffic feature vector as node attributes. The topology and node attributes of the network communication graph are dynamically updated according to the temporal changes of network traffic. An adaptive graph attention recognition module, connected to the dynamic graph construction and update module, is used to perform feature aggregation and propagation on the network communication graph based on the improved graph attention network, calculate the dynamic attention weights between nodes, and adaptively adjust the dynamic attention weights according to the topology change rate and node feature similarity of the network communication graph. It identifies malicious behavior patterns such as botnets, lateral movement, data leakage and advanced persistent threats, and outputs malicious behavior recognition results and confidence scores. The closed-loop feedback optimization module, connected to the adaptive graph attention recognition module, is used to evaluate the system's detection performance based on the malicious behavior recognition results and the confidence score. When the confidence score is lower than a preset threshold or a false alarm is detected, a parameter adjustment instruction is generated and fed back to the traffic feature multidimensional extraction module, the dynamic graph construction and update module, and the adaptive graph attention recognition module to adjust the feature extraction weight, graph update rate, and attention weight calculation parameters, forming a closed-loop optimization mechanism.

2. The network traffic deep packet inspection and malicious behavior identification system according to claim 1, characterized in that, The multi-dimensional traffic feature extraction module includes: a statistical feature extraction unit, used to extract the data packet size distribution, traffic rate, connection duration, and burstiness index of the network traffic; a protocol feature extraction unit, used to parse the transport layer protocol and application layer protocol of the network traffic, and extract protocol field features and protocol behavior patterns; a payload feature extraction unit, used to perform deep detection on the data packet payload of the network traffic, and extract payload byte distribution features and payload entropy values; and a time series feature extraction unit, used to extract the time interval sequence features and traffic time series fluctuation patterns of the network traffic.

3. The network traffic deep packet inspection and malicious behavior identification system according to claim 1, characterized in that, The dynamic graph construction and update module includes: an initial graph construction unit, used to construct the initial topology of the network communication graph based on the traffic feature vector; a topology change detection unit, used to detect changes in the topology of the network communication graph and calculate the topology change rate; a node attribute update unit, used to update the node attributes of the network communication graph according to the newly arrived network traffic; and an edge weight calculation unit, used to calculate the weight values ​​of the edges in the network communication graph according to the communication frequency and traffic size.

4. The network traffic deep packet inspection and malicious behavior identification system according to claim 1, characterized in that, The adaptive graph attention recognition module includes: a graph convolution feature aggregation unit, used to perform graph convolution operations on the network communication graph and aggregate neighbor node features; a dynamic attention calculation unit, used to calculate the dynamic attention weights between the nodes; a feature propagation unit, used to propagate feature information in the network communication graph according to the dynamic attention weights; and a malicious pattern matching unit, used to match the propagated node features with a preset malicious behavior pattern library to identify malicious behavior types.

5. The network traffic deep packet inspection and malicious behavior identification system according to claim 4, characterized in that, The dynamic attention calculation unit is used to: obtain the topology change rate and node feature similarity; generate a dynamic adjustment factor based on the topology change rate; calculate an initial attention coefficient based on the node feature similarity; and multiply the initial attention coefficient by the dynamic adjustment factor to obtain the dynamic attention weight.

6. The network traffic deep packet inspection and malicious behavior identification system according to claim 1, characterized in that, The closed-loop feedback optimization module includes: a performance evaluation unit, used to evaluate the detection accuracy, recall, and false positive rate based on the malicious behavior identification results and the confidence score; a parameter optimization strategy generation unit, used to generate the parameter adjustment instructions based on the detection accuracy, recall, and false positive rate; and a feedback scheduling unit, used to distribute the parameter adjustment instructions to the traffic feature multidimensional extraction module, the dynamic graph construction and update module, and the adaptive graph attention recognition module.

7. The network traffic deep packet inspection and malicious behavior identification system according to claim 1, characterized in that, The system also includes a real-time stream processing engine, which is connected to the multi-dimensional traffic feature extraction module and is used to collect, buffer, and distribute network traffic in real time, supporting a processing throughput of tens of millions of data packets per second.

8. The network traffic deep packet inspection and malicious behavior identification system according to claim 1, characterized in that, The system also includes a threat intelligence fusion module, which is connected to the adaptive graph attention recognition module and is used to obtain the latest malicious behavior characteristics from external threat intelligence sources and update the malicious behavior pattern library.

9. The network traffic deep packet inspection and malicious behavior identification system according to claim 1, characterized in that, The system also includes a visualization analysis module, which is connected to the adaptive graph attention recognition module and the dynamic graph construction and update module, and is used to visualize the network communication graph and the malicious behavior recognition results.

10. The network traffic deep packet inspection and malicious behavior identification system according to claim 1, characterized in that, The dynamic attention weight is calculated as follows: First, the node feature similarity is calculated as the initial attention coefficient. Then, a dynamic adjustment factor is generated based on the topology change rate of the network communication graph. The dynamic adjustment factor increases as the topology change rate increases. Finally, the initial attention coefficient is multiplied by the dynamic adjustment factor and normalized to obtain the dynamic attention weight.

Images