A method and system for malicious traffic monitoring based on graph neural network and adaptive concept drift

Abstract

The application discloses a kind of graph neural network and malicious traffic monitoring method and system of adaptive concept drift, it is related to internet, network security technology, including: the network data packet of original network traffic data collected is aggregated as session flow, and network traffic features are extracted;Any session is regarded as a node of network traffic graph, and network traffic graph is constructed;Using graph convolution operator, for each session node, the features of its associated node are aggregated to perform graph structure learning;Using independently initialized learnable weight matrix, the result of graph structure learning is enhanced;Based on the result of graph structure learning and enhanced features, train adversarial boundary generator, evidence classifier;For any input traffic sample, use the trained evidence classifier to monitor malicious traffic.The application constructs the traffic monitoring method capable of responding to encryption, collaboration, dynamic network threats.

Description

Technical Field

[0001] This application relates to the fields of Internet and network security technology, and in particular to a method and system for detecting malicious traffic using graph neural networks and adaptive concept drift. Background Technology

[0002] With the continuous expansion of the internet and the increasing complexity of business models, cyberattacks are becoming more covert, coordinated, and encrypted. More and more malicious communications are using encrypted channels such as SSL / TLS and DoH / VPN to deliver commands and penetrate data, rendering traditional detection mechanisms that rely on plaintext payloads and fixed rules (such as feature matching and deep packet inspection) increasingly ineffective. Detection scenarios are shifting from "checking content" to "looking at behavior / structure" and "anti-evasion." Simultaneously, the evolution of data distribution over time in real-world networks (concept drift) causes offline-trained models to rapidly degrade, leading to increased false positives / false negatives and significantly reducing engineering usability. The combination of these two challenges makes "stable detection of malicious traffic in dynamic, adversarial, and encrypted network environments" a key challenge for current research and industrial application.

[0003] Current methods for detecting malicious traffic can be broadly categorized into three types: traditional methods based on feature matching, statistical modeling methods based on machine learning, and intelligent detection methods based on deep learning.

[0004] Traditional feature-matching-based detection methods rely primarily on manually defined protocol features, port information, and packet rule bases to compare feature templates and identify abnormal traffic. While these methods are simple to implement and fast, their core limitation lies in their heavy reliance on known features. If attackers change the communication protocol or hide features through encryption or obfuscation, the detection model becomes completely ineffective and unable to cope with new attacks and encrypted traffic.

[0005] Machine learning-based detection methods extract statistical features of traffic (such as packet length distribution, direction ratio, and latency characteristics) and use algorithms like Support Vector Machines and Random Forests for classification. While these methods somewhat reduce reliance on manual rules, their effectiveness heavily depends on the stability of the data distribution. When the network environment or service type changes, the model needs to be retrained. Furthermore, these methods lack the ability to model the temporal and spatial dependencies of traffic, classifying only in a static feature space, making it difficult to capture the dynamic evolution of complex attack behaviors.

[0006] Existing malicious traffic detection technologies generally face multiple core challenges, including structural isolation, noise interference, model aging, and underreporting of unknown threats. Specifically, traditional single-flow detection ignores the topological dependencies between sessions, making it difficult to perceive the spatial correlation between botnet collaboration and jump-to-the-board attacks; high background noise (such as heartbeat packets) in encrypted channels severely interferes with the extraction of weak malicious signals; and facing the continuous conceptual drift of the real network environment, existing models lack the ability to update incrementally online with low resources, relying on full retraining, which leads to high maintenance costs; at the same time, models based on the closed-set assumption cannot effectively identify zero-day attacks. Therefore, how to achieve lightweight adaptive updates of models without relying on full retraining, and integrate spatiotemporal topology and noise resistance mechanisms to achieve accurate identification of unknown and collaborative attacks, has become a key issue that urgently needs to be addressed. Summary of the Invention

[0007] This application provides a malicious traffic monitoring method and system based on graph neural networks and adaptive concept drift, which can be used to construct a traffic monitoring method capable of dealing with encrypted, collaborative, and dynamic network threats.

[0008] This application provides a malicious traffic monitoring method based on graph neural networks and adaptive concept drift, including: The network packets of the collected raw network traffic data are aggregated into session streams, and network traffic features are extracted based on each session stream; Treat any session as a node in the network traffic graph, and denote the set of nodes as . The connection relationships between nodes are determined based on the interaction frequency and feature similarity between sessions, forming an edge set. and based on the edge set Generate adjacency matrix To characterize the topology of the flow; and, The extracted network traffic features are combined in node order to form a node feature matrix. Based on adjacency matrix With characteristic matrix Building a network traffic graph ; Using graph convolution operators, for each session node It aggregates the features of its associated nodes to perform graph structure learning; Using independently initialized learnable weight matrices, the results of graph structure learning are linearly transformed, and a multi-head attention mechanism is used to compute the correlation between features in parallel for feature enhancement. Based on the results of graph structure learning and the enhanced features, an adversarial boundary generator is trained to generate virtual anomaly samples. An evidence classifier is then trained, where the Softmax layer at the end of the deep neural network is replaced with an evidence layer, and either Softplus or ReLU activation functions are used to output a non-negative evidence vector. ; For any input traffic sample, malicious traffic is detected using a trained evidence classifier.

[0009] This application provides a malicious traffic monitoring system based on graph neural networks and adaptive concept drift, including a processor and a memory. The memory stores a computer program, which, when executed by the processor, implements the steps of the malicious traffic monitoring method based on graph neural networks and adaptive concept drift as described above.

[0010] This application embodiment constructs a traffic monitoring method capable of coping with encrypted, collaborative, and dynamic network threats by integrating the spatial modeling capabilities of graph neural networks, the noise resistance capabilities of attention mechanisms, and the adaptive capabilities of incremental learning.

[0011] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0012] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 This is a schematic diagram of the basic process of the malicious traffic monitoring method according to an embodiment of this application; Figure 2 This is a schematic diagram of traffic analysis and feature modeling for the malicious traffic monitoring method in this application embodiment; Figure 3 This is a schematic diagram of the graph structure learning process of the malicious traffic monitoring method in this application embodiment; Figure 4 This is a schematic diagram of the multi-head self-attention feature enhancement process of the malicious traffic monitoring method in this application embodiment; Figure 5 This is a schematic diagram of the concept drift detection process of the malicious traffic monitoring method in this application embodiment; Figure 6 This is a schematic diagram of the incremental learning process of the malicious traffic monitoring method in this application embodiment. Detailed Implementation

[0013] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0014] This application provides a malicious traffic monitoring method based on graph neural networks and adaptive concept drift. The method mainly includes steps such as traffic analysis and feature modeling, graph structure learning, multi-head self-attention feature enhancement, concept drift detection, incremental learning, and open set identification based on generative adversarial and evidence theories. This application integrates the spatial modeling capabilities of graph neural networks, the noise resistance of attention mechanisms, and the adaptive capabilities of incremental learning to construct a defense system capable of addressing encrypted, collaborative, and dynamic network threats. Figure 1 As shown, the specific method of this application includes the following steps: In step S101, the network data packets of the collected raw network traffic data are aggregated into session streams, and network traffic features are extracted based on each session stream.

[0015] Specifically, the raw network traffic is collected, parsed, cleaned, fragmented, feature-extracted, and formatted. Through multi-dimensional feature construction and standardization, high-quality structured input is provided for subsequent graph modeling and learning. In some embodiments, such as Figure 2 As shown, the network packets of the collected raw network traffic data are aggregated into session streams, and network traffic features are extracted based on each session stream, including: Raw packet data (raw network traffic data) is collected by network traffic collection devices or border firewalls, and the data is cleaned to remove invalid connections, duplicate packets and broadcast packets in order to reduce data redundancy.

[0016] The cleaned raw network traffic data is aggregated into session streams by five-tuples, and the session streams are sliced ​​using a fixed-length sliding window to form session slices, which provide time-related inputs for subsequent model learning. The five-tuples include source IP, destination IP, source port, destination port, and protocol type.

[0017] For each session slice, statistical features (including mean packet length, stream duration, and transmission rate) and temporal features (including packet interval distribution and peak frequency) are extracted. To eliminate the influence of units, robust standardization (RobustScaler) is used to process numerical features. The feature standardization formula is as follows: Where IQR is the interquartile range. This represents the median of the sample data. For discrete protocol features, one-hot encoding is used for vectorization.

[0018] In step S102, a network traffic graph is constructed, specifically by treating any session as a node in the network traffic graph, and the set of nodes is denoted as . The connection relationships between nodes are determined based on the interaction frequency and feature similarity between sessions, forming an edge set. and based on the edge set Generate adjacency matrix To characterize the topology of the flow; and, The extracted network traffic features are combined in node order to form a node feature matrix. Based on adjacency matrix With characteristic matrix Building a network traffic graph .

[0019] In step S103, the graph convolution operator is used for each session node. It aggregates the features of its associated nodes (i.e., other sessions with high-frequency interactions or similar behaviors) to perform graph structure learning.

[0020] In step S104, the results of graph structure learning are linearly transformed using independently initialized learnable weight matrices, and a multi-head attention mechanism is used to compute the correlation between features in parallel to enhance features.

[0021] In step S105, based on the results of graph structure learning and the enhanced features, an adversarial boundary generator is trained to generate virtual anomaly samples. An evidence classifier is also trained, where the Softmax layer at the end of the deep neural network is replaced with an evidence layer, and a Softplus or ReLU activation function is used to output a non-negative evidence vector. ; In step S106, malicious traffic is monitored for any input traffic sample using a trained evidence classifier.

[0022] The method proposed in this application achieves high-precision and sustainable detection of malicious behavior in encrypted traffic and dynamic network environments. It has significant advantages such as strong adaptability, good generalization, high robustness, and excellent real-time performance, providing a new technical approach for network security defense.

[0023] In some embodiments, such as Figure 3 As shown, using the graph convolution operator, for each session node... The process of aggregating the features of its associated nodes for graph structure learning includes: For each session node in the network traffic graph Perform feature updates: in , Represents a node In the , Feature vectors output by layered graph neural networks; This represents a non-linear activation function. In this example, the LeakyReLU function is chosen to preserve the weak gradient information in the negative region. Represents nodes Index of neighboring nodes with existing connections; Represents a node The set of neighboring nodes; Represents a node The degree; Indicates the first The learnable weight matrix of the layer. This step enables the model to infer the anomalous probability of the current node based on the maliciousness of its neighboring nodes, thereby identifying covert coordinated attackers.

[0024] In some embodiments, such as Figure 3 As shown, using the graph convolution operator, for each session node... In addition to aggregating the features of its associated nodes for graph structure learning, the following also applies: In multi-layer graph convolutional structures, inter-layer residual connections are introduced to facilitate deep semantic transfer and prevent degradation. In this example, to prevent the loss of original traffic features (such as specific payload signatures) during the smoothing process caused by multi-layer graph convolution, this invention introduces inter-layer residual connections. This design ensures that deep networks can obtain global topological coordination information while directly preserving the original session fingerprints from shallow layers, avoiding feature ambiguity caused by "over-smoothing."

[0025] Average pooling is performed on the node feature matrix output from the last layer of the multi-layer graph convolutional structure to generate a graph-level global feature representation for subsequent processing.

[0026] The node feature matrix before pooling As an intermediate result, this matrix is ​​saved and output, preserving the independent fine-grained features of each session node in the topology, which serves as the standard input for subsequent multi-head self-attention feature enhancement modules.

[0027] In existing technologies, normal background traffic (such as heartbeat packets and polling requests) often constitutes strong noise, interfering with the identification of weak attack signals. This module is not a general attention mechanism, but a specially designed traffic feature denoising layer. In some embodiments, such as Figure 4 As shown, multi-head self-attention feature enhancement includes using independently initialized learnable weight matrices to perform a linear transformation on the graph structure learning results, and employing a multi-head attention mechanism to compute the correlation between features in parallel: The node feature matrix before pooling Using three independently initialized learnable weight matrices , and For the input node feature matrix Perform linear transformation operations; Through matrix multiplication , , , the feature matrix Linear projection onto three different feature subspaces yields the query matrix for each. Key matrix Sum matrix .

[0028] Use a multi-head attention mechanism to compute the correlation between features in parallel: in, The query matrix is ​​represented by the node feature matrix. Obtained through linear transformation; Represents the key matrix; Represents a value matrix, The dimension of the key vector is used as a scaling factor to prevent the dot product from becoming too large and causing gradient vanishing. Different attention heads are then focused on "temporal burst mode" (for DDoS attacks) and "payload content mode" (for SQL injection attacks, etc.).

[0029] In some embodiments, noise suppression and key feature weighting are also included: Through attention weight matrix Node feature matrix Weighted reorganization is performed to suppress features with weights below a preset threshold (identified as redundant background traffic) through layer normalization; while features with high weights (identified as critical paths of attack behavior) are amplified. This enables the model to still identify key malicious behavior segments when faced with encrypted traffic with high background noise.

[0030] In some embodiments, such as Figure 5 As shown, it also includes concept drift detection based on enhanced features, including: Calculate the detection error rate within the sliding window for the enhanced features. Compared with historical average Compare, if there is a deviation If the threshold is exceeded, a drift is determined to have occurred; Drift consistency detection is performed over k consecutive time windows, and drift confirmation is achieved by combining feature distribution differences. In the case of drift confirmation, an event flag is generated and the following incremental learning is triggered to prevent model aging.

[0031] This example proposes a low-resource-consumption incremental learning module to address the challenges of limited computing resources and the need for real-time response to "concept drift" in edge network devices. It also suggests a memory-enhanced update strategy based on partial parameter freezing, rather than traditional full retraining. Figure 6 As shown, the specific steps are as follows: Representative sample replay (anti-forgetting mechanism). Maintain a sample cache pool with limited capacity, retain the most representative boundary samples in the old class based on feature distinctness, and mix them with newly collected samples to prevent catastrophic forgetting when the model learns new attacks.

[0032] Local parameter fine-tuning (resource optimization). Upon triggering an update, the parameters of the general feature extraction layer at the bottom of the graph neural network are frozen, and gradient updates are performed only on the weights of the top-level evidence classifier and attention weights. During fine-tuning, newly acquired samples and generated boundary samples are used to minimize the evidence loss function, correcting the classifier's evidence support for each category and ensuring that evidence uncertainty accurately reflects emerging traffic patterns. This design is based on the assumption that "bottom-level traffic features are universal, while high-level discrimination boundaries change with attack variants," significantly reducing computational overhead and adapting to the real-time requirements of edge gateways.

[0033] Smooth parameter fusion. An exponential moving average (EMA) strategy is used to fuse the old model parameters with the newly fine-tuned parameters to ensure the online stability of the model. The parameter update formula is as follows: in, This represents the smoothing coefficient, with a value between 0 and 1. This prevents the model parameters from drastically fluctuating when faced with sudden abnormal traffic, ensuring the online stability of the detection system. After updating the model parameters, the feature centers and covariance matrices of each known category are recalculated based on the updated model using representative samples from the cache pool (or newly collected samples), and the feature library is updated.

[0034] In some embodiments, step S105, based on the results of graph structure learning and the enhanced features, trains an adversarial boundary generator to generate virtual outlier samples and trains an evidence classifier. This step is an open set identification step based on generative adversarial and evidence theory. This example abandons the traditional distance threshold determination method and adopts a strategy combining "adversarial boundary synthesis" and "evidence uncertainty quantification." It actively generates virtual outliers at the feature boundaries of known categories, forcing the model to form a tight decision boundary, and directly quantifies the cognitive uncertainty of the samples using evidence theory. Specifically, it includes: Adversarial Boundary Sample Generation (Training Phase): Construct an adversarial boundary generator.

[0035] Its input is the feature vector obtained after graph structure learning and attention enhancement. During training, the generator aims to generate "virtual anomalous samples" located on the edges of known category feature clusters. The objective function consists of two parts: one is the "approximation term," which makes the generated objective function more accurate and efficient. The first approach involves getting the generated samples as close as possible to the center of the known class to simulate highly covert attacks; the second is the "discriminant term," which forces these generated samples to be located in low-probability-density regions. Through this adversarial game, a highly sensitive "vacuum zone" is formed around the feature space of the known class, thereby compressing the decision boundary of the known class more compactly.

[0036] Evidence classifier construction and reasoning The Softmax layer at the end of a traditional deep neural network is replaced with an evidence layer, using either Softplus or ReLU activation functions to output a non-negative evidence vector. ,in This represents the amount of supporting evidence the model provides for the known traffic in the Kth class. Based on subjective logic theory, the output of the neural network is considered as the parameters of a Dirichlet distribution. For any input traffic sample x, its corresponding Dirichlet distribution parameters are... .

[0037] After training is complete, in some embodiments, malicious traffic detection using the trained evidence classifier on any input traffic sample includes: Cognitive uncertainty in calculating input flow samples : Where K is the total number of known categories, and S is the total evidence strength of the input traffic samples. ; like , If the preset uncertainty threshold is set, it indicates that the model has failed to extract valid evidence belonging to any known category in the sample, and the sample is judged as an "unknown class / zero-day attack" or a severe "concept drift sample".

[0038] like If it has the highest expected probability, then it is determined to have the highest expected probability. The known categories. The method in this application combines evidence deep learning to directly output the cognitive uncertainty of the samples, avoiding the problems of traditional methods that rely on unreliable probability values ​​or complex covariance matrix inversion operations, thus improving the detection rate of zero-day attacks.

[0039] The method in this application utilizes the structured modeling capabilities of graph neural networks to map the session relationships, host interactions, and communication topology of network traffic into a graph structure. This enables the model to simultaneously capture the spatial dependencies and temporal dynamics of traffic features, overcoming the shortcomings of traditional methods that rely solely on static features and ignore traffic correlations. The introduced multi-head self-attention mechanism adaptively assigns higher weights to key features, suppressing redundant and noisy features, thereby improving the accuracy and robustness of malicious traffic feature extraction.

[0040] Regarding model adaptation, this invention employs a concept drift detection mechanism based on error rate monitoring, which can identify dynamic changes in traffic distribution in real time and trigger incremental learning modules to locally update model parameters without requiring full retraining. This significantly improves the system's real-time adaptability and operational efficiency in complex network environments. Furthermore, the proposed open set identification module represents a leap from "passive distance measurement" to "active boundary defense." By introducing an adversarial boundary generation mechanism, it actively simulates difficult examples at the classification boundary during the training phase, making the model highly sensitive to highly concealed variant attacks.

[0041] This application also proposes a malicious traffic monitoring system based on graph neural networks and adaptive concept drift, including a processor and a memory. The memory stores a computer program, which, when executed by the processor, implements the steps of the malicious traffic monitoring method based on graph neural networks and adaptive concept drift as described above.

[0042] It should be noted that, in the embodiments of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0043] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0044] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0045] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims. All of these forms are within the protection scope of this application.

Claims

1. A malicious traffic monitoring method based on graph neural networks and adaptive concept drift, characterized in that, include: The network packets of the collected raw network traffic data are aggregated into session streams, and network traffic features are extracted based on each session stream; Treat any session as a node in the network traffic graph, and denote the set of nodes as . The connection relationships between nodes are determined based on the interaction frequency and feature similarity between sessions, forming an edge set. and based on the edge set Generate adjacency matrix To characterize the topology of the flow; and, The extracted network traffic features are combined in node order to form a node feature matrix. Based on adjacency matrix With characteristic matrix Building a network traffic graph ; Using graph convolution operators, for each session node It aggregates the features of its associated nodes to perform graph structure learning; Using independently initialized learnable weight matrices, the results of graph structure learning are linearly transformed, and a multi-head attention mechanism is used to compute the correlation between features in parallel for feature enhancement. Based on the results of graph structure learning and the enhanced features, an adversarial boundary generator is trained to generate virtual anomaly samples. An evidence classifier is then trained, where the Softmax layer at the end of the deep neural network is replaced with an evidence layer, and either Softplus or ReLU activation functions are used to output a non-negative evidence vector. ; For any input traffic sample, malicious traffic is detected using a trained evidence classifier.

2. The malicious traffic monitoring method based on graph neural networks and adaptive concept drift as described in claim 1, characterized in that, The network packets of the collected raw network traffic data are aggregated into session streams, and network traffic features are extracted based on each session stream, including: Collect raw network traffic data and perform data cleaning to remove invalid connections, duplicate packets, and broadcast packets; The cleaned raw network traffic data is aggregated into session streams by five-tuples, and the session streams are sliced ​​using a fixed-length sliding window to form session slices. The five-tuples include source IP, destination IP, source port, destination port, and protocol type. For each session slice, statistical features and temporal features are extracted, and then standardized and vectorized as network traffic features.

3. The malicious traffic monitoring method based on graph neural networks and adaptive concept drift as described in claim 2, characterized in that, Using graph convolution operators, for each session node The process of aggregating the features of its associated nodes for graph structure learning includes: For each session node in the network traffic graph Perform feature updates: in , Represents a node In the , Feature vectors output by layered graph neural networks; Represents a non-linear activation function. Represents nodes Index of neighboring nodes with existing connections; Represents a node The set of neighboring nodes; Represents a node The degree; Indicates the first The learnable weight matrix of the layer.

4. The malicious traffic monitoring method based on graph neural networks and adaptive concept drift as described in claim 3, characterized in that, Using graph convolution operators, for each session node In addition to aggregating the features of its associated nodes for graph structure learning, the following also applies: In multi-layer graph convolutional structures, inter-layer residual connections are introduced; Average pooling is performed on the node feature matrix output from the last layer of the multi-layer graph convolutional structure to generate a graph-level global feature representation. The node feature matrix before pooling Save and output as intermediate results.

5. The malicious traffic monitoring method based on graph neural networks and adaptive concept drift as described in claim 3, characterized in that, Using independently initialized learnable weight matrices, a linear transformation is performed on the results of graph structure learning, and a multi-head attention mechanism is employed to compute the correlations between features in parallel, including: The node feature matrix before pooling Using three independently initialized learnable weight matrices , and For the input node feature matrix Perform linear transformation operations; Through matrix multiplication , , , the feature matrix Linear projection onto three different feature subspaces yields the query matrix for each. Key matrix Sum matrix ; Use a multi-head attention mechanism to compute the correlation between features in parallel: in, The query matrix is ​​represented by the node feature matrix. Obtained through linear transformation; Represents the key matrix; Represents a value matrix, This represents the dimension of the key vector.

6. The malicious traffic monitoring method based on graph neural networks and adaptive concept drift as described in claim 5, characterized in that, Also includes: Through attention weight matrix node feature matrix Weighted reorganization is performed to suppress features with weights below a preset threshold through layer normalization; For features with weights higher than a preset threshold, the signal is amplified.

7. The malicious traffic monitoring method based on graph neural networks and adaptive concept drift as described in claim 1, characterized in that, It also includes concept drift detection based on enhanced features, including: Calculate the detection error rate within the sliding window for the enhanced features. Compared with historical average Compare, if there is a deviation If the threshold is exceeded, a drift is determined to have occurred; Drift consistency detection is performed over k consecutive time windows, and drift confirmation is achieved by combining feature distribution differences. In the case of drift confirmation, an event flag is generated and the following incremental learning is triggered.

8. The malicious traffic monitoring method based on graph neural networks and adaptive concept drift as described in claim 1, characterized in that, For any input traffic sample, malicious traffic detection using a trained evidence classifier includes: Cognitive uncertainty in calculating input flow samples : Where K is the total number of known categories, and S is the total evidence strength of the input traffic samples; like , If the preset uncertainty threshold is used, the sample is determined to be an unknown type / zero-day attack or a severe concept drift sample; like If it is determined to have the highest expected probability, then it is considered to have the highest expected probability. The known categories.

9. A malicious traffic monitoring system based on graph neural networks and adaptive concept drift, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program that, when executed by the processor, implements the steps of the malicious traffic monitoring method with graph neural networks and adaptive concept drift as described in any one of claims 1 to 8.

Images