A network threat perception system based on full-flow mirror analysis

Abstract

This invention discloses a network threat perception system based on full traffic mirroring analysis, belonging to the field of network traffic security technology. Specifically, it includes: receiving full traffic mirroring data, completing network layer fragmentation and transport layer TCP stream reassembly, establishing a bidirectional network session stream, extracting payload features and retaining protocol control messages; generating interactive behavior feature vectors based on the message arrival time interval transition matrix; extracting the initial session interaction message field and constructing a cryptographic feature set by combining the payload byte sequence information entropy; splicing and fusing the two types of features to generate a global multidimensional feature tensor; constructing a communication attribute graph with the addresses of both communicating parties as nodes and the feature tensor as edge attributes; introducing a graph attention neural network to aggregate node representations, fusing features to generate a prediction vector, and outputting classification labels to complete threat determination, effectively identifying encrypted, obfuscated, and variant unknown attack traffic.

Description

Technical Field

[0001] This invention relates to the field of network traffic security technology, specifically to a network threat perception system based on full traffic mirroring analysis. Background Technology

[0002] With the continuous expansion of modern computer networks and the increasing complexity of underlying communication infrastructure, network security has become a core element in ensuring the continuity of various business systems. To achieve comprehensive network status monitoring without interfering with the original network topology and normal business operations, a technical architecture based on full-traffic mirroring analysis is widely deployed in enterprise-level security boundaries and core backbone networks. This technology typically utilizes devices such as switch port mirroring or optical splitters to losslessly copy bidirectional traffic from the original physical network links and redirect it to bypass security sensing devices for centralized processing. In the specific threat detection process, existing network threat perception systems are generally built upon deep packet inspection (DPI) and static signature matching mechanisms. The system performs layer-by-layer protocol parsing on the captured full-traffic mirror data, extracting the header and payload content of data packets and key fields. It then performs precise string or regular expression comparisons with a pre-built massive database of known threat signatures, thereby achieving the perception and alerting of various common network attack behaviors.

[0003] However, in the deep detection phase of full-traffic mirroring analysis, existing technologies largely rely on traditional deep packet inspection and static signature matching mechanisms. With the continuous escalation of network attack and defense, modern network attacks often employ advanced evasion techniques such as traffic encryption, protocol obfuscation, and payload fragmentation to conceal malicious behavior. Existing systems struggle to effectively deconstruct and extract deep-level network behavior characteristics when processing such highly complex mirrored traffic. Single-dimensional feature comparison not only fails to penetrate encrypted traffic to identify anomalies but also struggles to cope with frequently evolving and unknown threats. This rigid feature extraction and analysis mechanism significantly reduces the system's accuracy in identifying covert communications and unknown attacks in massive full-traffic environments. Summary of the Invention

[0004] The purpose of this invention is to provide a network threat perception system based on full traffic mirroring analysis, thereby solving the problems in the background technology.

[0005] The objective of this invention can be achieved through the following technical solutions: A network threat awareness system based on full traffic mirroring analysis includes: The traffic reassembly module is used to receive full traffic mirror data, sequentially perform network layer fragmentation reassembly and transport layer TCP stream reassembly, establish bidirectional network session streams, extract payload characteristics, and retain protocol control messages. The behavior feature module is used to calculate the transition matrix of the packet arrival time interval in the bidirectional network session flow and generate the interactive behavior feature vector of the bidirectional byte length distribution of the packets. The cryptographic feature module is used to extract data packet feature fields from the initial interaction phase of the bidirectional network session stream and construct a cryptographic feature set by combining the information entropy distribution of the payload byte sequence in the bidirectional network session stream. The feature tensor module is used to numerically concatenate the interactive behavior feature vector with the cryptographic feature set to generate a global multidimensional feature tensor representing the bidirectional network session flow. The attribute graph construction module is used to construct a network communication attribute graph with the network addresses of the two communicating parties in a bidirectional network session as nodes and global multidimensional feature tensors as edge attributes. The threat classification module is used to input the network communication attribute graph into the graph attention neural network model to perform node representation aggregation operations, fuse and splice the aggregated node representations of the two communicating parties with the original edge attributes, generate edge prediction vectors and output edge classification labels to determine the threat category.

[0006] As a further aspect of the present invention: in the traffic reassembly module, the process of receiving full traffic mirror data, sequentially performing network layer fragmentation reassembly and transport layer TCP stream reassembly, establishing a bidirectional network session stream, extracting payload features, and simultaneously retaining protocol control messages is as follows: Receive full traffic mirror data, parse the identifier and fragment offset in the network layer header, and concatenate fragmented packets with the same identifier according to the fragment offset order to complete the network layer fragmentation and reassembly. Parse the transport layer header of the reassembled message, construct a communication 5-tuple using the network address and TCP port, combine messages belonging to the same communication 5-tuple according to the sequence number, establish a bidirectional network session stream, and complete the transport layer TCP stream reassembly. The header of packets in the bidirectional network session stream is stripped and the data area is truncated to extract payload characteristics. Packets that lack data area and only carry TCP flags are retained as protocol control packets.

[0007] As a further aspect of the present invention: in the behavior feature module, the process of calculating the transition matrix of the packet arrival time interval in the bidirectional network session flow and generating the interactive behavior feature vector of the bidirectional byte length distribution of the packets is as follows: Extract the arrival timestamp difference of adjacent packets in the bidirectional network session flow to construct a time interval sequence, and discretize the time interval sequence according to the numerical range to map it into a time state sequence; The transition frequency of adjacent time states in the statistical time state sequence is calculated, the proportion of each transition frequency to the total transition frequency is calculated, and a transition matrix of the packet arrival time interval in the bidirectional network session flow is constructed. Extract the payload byte lengths of forward and reverse packets in the bidirectional network session stream and calculate the frequency ratio. Combine this with the transition matrix to generate an interactive behavior feature vector of the bidirectional byte length distribution of packets.

[0008] As a further aspect of the present invention: in the cryptographic feature module, the process of extracting data packet feature fields from the initial interaction phase of the bidirectional network session stream and constructing a cryptographic feature set by combining the information entropy distribution of the payload byte sequence in the bidirectional network session stream is as follows: Capture the handshake negotiation message during the initial interaction phase of the bidirectional network session flow, and extract the protocol version number, cipher suite identifier, and extended parameter length from the handshake negotiation message as data packet feature fields; The payload byte sequence of the bidirectional network session stream is truncated by a fixed step size and window. The Shannon information entropy of the frequency of byte values ​​in each truncation window is calculated to generate the information entropy distribution of the payload byte sequence. Numerical encoding is performed on the data packet feature fields to generate a numerical feature vector. This numerical feature vector is then concatenated with the information entropy distribution of the payload byte sequence to construct the cryptographic feature set of the bidirectional network session stream.

[0009] As a further aspect of the present invention: in the feature tensor module, the process of numerically concatenating the interaction behavior feature vector with the cryptographic feature set to generate a global multidimensional feature tensor representing the bidirectional network session flow is as follows: Extract the numerical distribution parameters of the interaction behavior feature vector and the cryptographic feature set, and perform data scaling operations based on the numerical distribution parameters to generate standardized behavior feature vectors and standardized cryptographic feature sets; Obtain the shape parameters of the standardized behavioral feature vector and the standardized cryptographic feature set, and perform zero-padded operation on the two based on the maximum shape parameter to construct the aligned behavioral feature matrix and the aligned cryptographic feature matrix; Determine the tensor splicing axis direction parameter, perform data concatenation of the alignment behavior feature matrix and the alignment cryptographic feature matrix along the tensor splicing axis direction parameter, and add channel dimension to generate a global multidimensional feature tensor representing the bidirectional network session flow.

[0010] As a further aspect of the present invention: in the attribute graph construction module, the process of constructing a network communication attribute graph using the network addresses of the two communicating parties in a bidirectional network session as nodes and the global multidimensional feature tensor as edge attributes is as follows: Extract the source and destination network addresses from the bidirectional network session flow, remove duplicate network addresses to establish a global network address set, assign a unique node index number to each network address in the global network address set, and generate a node set for the network communication attribute graph. Based on the interaction direction of the bidirectional network session flow, the node index number corresponding to the source network address is set as the edge start point, and the node index number corresponding to the destination network address is set as the edge end point. A directed connection is established between the edge start point and the edge end point to generate the edge set of the network communication attribute graph. Retrieve the global multidimensional feature tensor representing the bidirectional network session flow, perform matching and binding between the global multidimensional feature tensor and the corresponding directed connection in the edge set, establish the global multidimensional feature tensor as the edge attribute of the directed connection, and construct the edge attribute set of the network communication attribute graph. The node set and edge set of the network communication attribute graph are constructed to generate an adjacency matrix that reflects the connection relationship between nodes. The adjacency matrix and the edge attribute set are encapsulated in a graph structure to construct a network communication attribute graph with network addresses as nodes and global multidimensional feature tensors as edge attributes.

[0011] As a further aspect of the present invention: in the threat classification module, the process of generating edge prediction vectors and outputting edge classification labels to determine the threat category is as follows: The network communication attribute graph is input into the graph attention neural network model, the attention weights of nodes and their associated nodes are calculated, and the weighted aggregation operation is performed on the features of associated nodes based on the weights to generate the aggregated node representations of the two communicating parties. Extract the aggregated node representations of the two communicating parties, and perform matrix concatenation operations along the same feature dimension on the source node representation, the destination node representation, and the corresponding original edge attributes between them to complete the data fusion and splicing, and obtain the feature matrix. The fused and spliced ​​feature matrix is ​​input into a multilayer perceptron to perform nonlinear mapping, the output numerical sequence is extracted to generate edge prediction vectors, the probability distribution function is used to perform mapping calculations on the edge prediction vectors, and the edge classification label corresponding to the highest probability is output. Establish a mapping table between edge classification labels and network attack types. Perform a search and matching on the output edge classification labels in this mapping table, extract the content of matching mapping entries, and determine the threat category of the bidirectional network session flow.

[0012] As a further aspect of the present invention: the specific method for performing mapping calculations on the edge prediction vector using a probability distribution function and outputting the edge classification label corresponding to the highest probability is as follows: The fused and spliced ​​feature matrix is ​​input into a multilayer perceptron. In the hidden layer, the activation function is used to perform matrix multiplication and nonlinear transformation on the feature matrix. The output value sequence of the output layer is extracted to generate the edge prediction vector. Input the edge prediction vector into the probability distribution function, calculate the natural index value of each element in the edge prediction vector, divide the natural index value of a single element by the sum of the natural index values ​​of all elements, and obtain the probability score corresponding to each category to complete the mapping calculation. Iterate through all the probability scores corresponding to the categories generated by the mapping calculation, perform a numerical comparison operation on the aforementioned probability scores, locate the probability score with the largest value, extract the category index associated with the dimension of the largest probability score, and output the edge classification label corresponding to the largest probability.

[0013] The beneficial effects of this invention are: This invention effectively overcomes the shortcomings of traditional deep packet inspection in handling encrypted and obfuscated traffic by constructing a multi-dimensional fused feature tensor. The system first performs deep fragmentation and stream reassembly on the entire traffic to establish a bidirectional session stream, thoroughly reconstructing the real process of network interaction. Based on this, the system abandons the reliance on static signatures of plaintext payloads and innovatively extracts interactive behavior features such as the packet arrival time interval transition matrix and bidirectional byte length distribution, and constructs a cryptographic feature set by combining the handshake negotiation field and payload information entropy. The global multi-dimensional feature tensor generated by concatenating these two types of features can accurately characterize the deep-seated anomalies in the temporal interaction and statistical distribution of malicious traffic without decryption, thereby significantly improving the system's ability to identify and penetrate covert communications employing advanced evasion techniques such as traffic encryption, protocol obfuscation, and payload fragmentation.

[0014] This invention utilizes a graph attention neural network to construct a structured graph analysis mechanism, significantly enhancing the detection accuracy of frequent variants and unknown threats. The system constructs a network communication attribute graph using the network addresses of communicating parties as nodes and multidimensional feature tensors as edge attributes, transforming isolated network sessions into graph-structured data with spatial topological relationships. By performing node representation aggregation operations through a graph attention model, the system can dynamically focus on the contextual communication relationships of suspicious nodes, capturing hidden patterns of association between different network entities. Finally, the aggregated and updated node features are fused with the original edge features for edge classification prediction. This AI analysis mechanism, which integrates global network topology and local multidimensional communication features, completely breaks through the rigid limitations of single-dimensional feature comparison, enabling it to maintain efficient and accurate perception of unknown threats and variant attacks even in massive and highly complex full-traffic environments. Attached Figure Description

[0015] The invention will now be further described with reference to the accompanying drawings.

[0016] Figure 1 This is a schematic diagram of a network threat perception system based on full traffic mirroring analysis according to the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Please see Figure 1 As shown, the present invention is a network threat perception system based on full traffic mirroring analysis, comprising: The traffic reassembly module is used to receive full traffic mirror data, sequentially perform network layer fragmentation reassembly and transport layer TCP stream reassembly, establish bidirectional network session streams, extract payload characteristics, and retain protocol control messages. The behavior feature module is used to calculate the transition matrix of the packet arrival time interval in the bidirectional network session flow and generate the interactive behavior feature vector of the bidirectional byte length distribution of the packets. The cryptographic feature module is used to extract data packet feature fields from the initial interaction phase of the bidirectional network session stream and construct a cryptographic feature set by combining the information entropy distribution of the payload byte sequence in the bidirectional network session stream. The feature tensor module is used to numerically concatenate the interactive behavior feature vector with the cryptographic feature set to generate a global multidimensional feature tensor representing the bidirectional network session flow. The attribute graph construction module is used to construct a network communication attribute graph with the network addresses of the two communicating parties in a bidirectional network session as nodes and global multidimensional feature tensors as edge attributes. The threat classification module is used to input the network communication attribute graph into the graph attention neural network model to perform node representation aggregation operations, fuse and splice the aggregated node representations of the two communicating parties with the original edge attributes, generate edge prediction vectors and output edge classification labels to determine the threat category.

[0019] In one embodiment of the present invention, the traffic reassembly module receives full traffic mirror data, sequentially performs network layer fragmentation reassembly and transport layer TCP stream reassembly, establishes a bidirectional network session stream, extracts payload features, and retains protocol control messages. The process is as follows: After acquiring the full traffic mirror data, the underlying capture driver reads the Ethernet frame structure of the original data packet and locates the network layer protocol header. By parsing the 16-bit identifier field, 3-bit flag bits, and 13-bit fragment offset in the Internet Protocol (IP) header, it determines whether the data packet belongs to a fragmented original large packet. Due to the maximum transmission unit (MTU) limitation in network links, larger data packets are divided into multiple fragments for transmission, and the same identifier ensures that these fragments originate from the same original packet. In practice, a reassembly buffer is maintained in memory based on the source network address, destination network address, protocol number, and identifier as keys, and packets with the same key value are grouped into the same reassembly queue. Based on the byte offset value recorded by the fragment offset, the fragment payloads are arranged in ascending order and filled into a preset buffer space; if the sum of the offsets plus the current fragment length equals the total length of the original packet, the reassembly is considered complete. This method of splicing data according to offset order can effectively restore the original business meaning that was cut by network devices, ensuring that the analysis content is not broken due to physical transmission limitations, thus providing a complete and continuous data foundation for higher-level protocol parsing.

[0020] After network layer reassembly, the transport layer header information of the reassembled message is extracted, specifically involving five core dimensions: source network address, destination network address, source port number, destination port number, and transport layer protocol number. This forms a five-tuple structure that uniquely identifies the communication. In actual processing, the hash value of the five-tuple is calculated and quickly searched in a memory-mapped table to check if an established session context exists. To establish a complete bidirectional session flow, the source and destination information are symmetrically interchanged, allowing the two unidirectional flows from sender to receiver and from receiver to sender to be associated with the same logical session. Using the 32-bit sequence number and acknowledgment number in the Transmission Control Protocol (TCP) header, messages belonging to the same session are strictly ordered, resolving potential out-of-order or retransmission issues during network transmission. The sequence number represents the relative position of the message payload in the byte stream; by comparing the expected sequence number with the sequence number of the currently arriving message, the continuity of the data stream can be accurately determined. The core principle of this reassembly mechanism based on quintuples and sequence numbers is to utilize the self-synchronization characteristics of transport layer protocols to transform discrete packets into logically unified bidirectional data interaction links, providing necessary structured support for analyzing application layer interaction logic.

[0021] For established bidirectional network session flows, further refined data feature extraction is needed. Specifically, this involves parsing the message header length field to accurately calculate the payload start offset position after the transport layer header. By stripping the encapsulation headers of the network and transport layers, the data region from the offset address to the end of the total message length is extracted to obtain the original application layer payload content. During extraction, special attention is paid to the byte sequence distribution of the payload, using it as raw material for feature analysis. Simultaneously, special messages with zero payload length and carrying only transport control protocol flags are identified. These messages typically contain control information such as synchronization requests, acknowledgments, connection termination, or connection resets. Although they do not carry business data, they record the interaction rhythm and state transition logic between the communicating parties. The reason for retaining these protocol control messages is that the combination and distribution of their flags can reflect abnormal network behavior preferences; for example, frequent reset messages may indicate scanning attacks or connection anomalies, while the density of synchronization messages is highly correlated with denial-of-service attacks. This strategy of separating and retaining payload and control information not only yields in-depth data features but also preserves key communication control logic, achieving a full-dimensional reconstruction of network interaction information.

[0022] In one embodiment of the present invention, the process of calculating the transition matrix of the packet arrival time interval in the bidirectional network session flow and generating the interactive behavior feature vector of the bidirectional byte length distribution of the packets in the behavior feature module is as follows: The nanosecond-level timestamp information of each data packet in the bidirectional network session stream is extracted in real time using a capture tool, recording the precise moment when the packet enters the monitoring point. For a communication stream containing 30 packets, the arrival time intervals of 29 adjacent packets are obtained by calculating the time difference between the 2nd and 1st packets and between the 3rd and 2nd packets, thus forming a raw time interval sequence reflecting communication frequency fluctuations. Since the raw time values ​​are continuous and high-dimensional, making direct feature extraction difficult, a numerical interval discretization method is adopted. A series of non-overlapping left-closed and right-open numerical intervals are pre-defined. For example, time intervals greater than or equal to 0 milliseconds and less than 5 milliseconds are divided into interval 1, time intervals greater than or equal to 5 milliseconds and less than 20 milliseconds are divided into interval 2, time intervals greater than or equal to 20 milliseconds and less than 100 milliseconds are divided into interval 3, and time intervals greater than or equal to 100 milliseconds are divided into interval 4. If a time interval is 15 milliseconds, it is automatically categorized and mapped to time state 2; if a time interval is exactly 20 milliseconds, it is explicitly categorized and mapped to time state 3 according to the set interval division rules. Finally, the entire interval sequence is converted into a numerical sequence consisting of states 1 to 4, i.e., a time state sequence. The reason for obtaining the state sequence in this way is that discretization can effectively filter out minor time deviations caused by network congestion or link jitter, focusing on the macroscopic communication rhythm, thus ensuring that similar threat behaviors exhibit consistent characteristics across different network environments.

[0023] After obtaining the time-state sequence composed of numbers, the focus is on analyzing the evolutionary patterns between adjacent time states, i.e., counting the specific frequency of each time state transitioning to another. Assuming the state space size is 4, a 4x4 statistical table is constructed to record the number of times state 1 is immediately followed by state 1, or the number of times state 2 appears after state 1. Traversing the entire time-state sequence with 50 transition relationships, if the transition from state 2 to state 3 occurs 10 times, and the total number of transitions is 50, then the proportion of this transition path is determined to be 0.2. By calculating the frequency proportion of all 16 possible transition combinations, the entire matrix is ​​finally filled, ensuring that each element represents the probability of a specific time rhythm switch, and the sum of the values ​​in each row should be exactly equal to 1. The principle behind constructing this transition matrix is ​​based on the idea of ​​a Markov chain, which not only considers the delay of individual messages but also captures the dynamic correlation and evolutionary trend of the message sequence in the time dimension.

[0024] While processing temporal characteristics, the payload byte length of each packet is extracted from the bidirectional network session flow, and the flow is divided into forward flow (from the initiator to the responder) and reverse flow (in the opposite direction) based on the direction of traffic. Taking forward flow as an example, the distribution of all forward packet lengths within different intervals is statistically analyzed, such as the proportion of short packets (0 to 64 bytes) or large packets (over 1000 bytes, close to the maximum transmission unit of 1500 bytes). If a session contains 100 forward packets, 80 of which are very short control packets, the frequency ratio of this length interval is recorded as 0.8. The same calculation process is performed on the reverse flow to obtain the complete bidirectional byte length distribution characteristics. To form a feature vector representing the entire session, the previously obtained transition matrix is ​​flattened according to the row-major principle, transformed into a long vector, and then horizontally concatenated with the forward and reverse byte length ratio vectors. The interaction behavior feature vector obtained through this concatenation operation integrates the temporal regularity and spatial size dimensions. This is done because cyber threat behavior often exhibits anomalies in both time and space. For example, some detection tools maintain a constant high-frequency time interval during scanning, accompanied by probe packets of fixed length. By fusing feature vectors in this way, these multi-dimensional subtle feature differences can be captured in all aspects.

[0025] In one embodiment of the present invention, the process of extracting data packet feature fields from the initial interaction phase of the bidirectional network session stream and constructing a cryptographic feature set by combining the information entropy distribution of the payload byte sequence in the bidirectional network session stream in the cryptographic feature module is as follows: The process involves locating the critical handshake interaction phase at the beginning of a bidirectional network session and performing message interception to obtain the original message data packets containing security capability negotiation information. When parsing the payload content above the transport layer, key fields are accurately located by identifying specific byte offsets. For example, in transport layer security protocols, values ​​representing protocol version numbers are searched; for instance, the value 771 is extracted as a protocol version characteristic to represent a specific version. The handshake message contains a set of encryption algorithms supported by the communicating end. By sequentially reading the cipher suite list and parsing out the specific suite identifier codes, such as extracting cipher suite combination identifiers like values ​​49195 and 49196, this sequence of values ​​is recorded as the identity attribute fingerprint of the communication link. Furthermore, the total byte length of all extended parameters at the end of the handshake message needs to be parsed and calculated; for example, the extended length value of 125 is accurately extracted. Calculating this value can indirectly reflect the implementation details of the underlying software library and the configuration of specific security components. The reason for extracting these data fields to obtain packet feature fields is that the negotiation logic exhibited by different types of network applications or malicious control programs during the handshake phase is highly unique. By utilizing this specific fingerprint phenomenon and capturing static metadata such as protocol version number, encryption suite, and extension length, a first-level identification benchmark can be established without cracking the encrypted content. This provides strong deterministic data support for accurately characterizing the underlying security attributes and behavioral preferences of both communicating parties.

[0026] For the recombined bidirectional network session stream, dynamic feature sampling is performed on the payload byte sequence. First, a fixed step size is pre-defined, for example, 64 bytes, and a sliding window truncation model with a window size of 256 bytes is adopted. This model starts from the first byte of the payload sequence, moving 64 bytes to the right each time, and truncating all 256 bytes of data within the current window. For each truncated window block, the frequency of the 256 possible byte values ​​from 0 to 255 is statistically analyzed, and these frequencies are substituted into the Shannon entropy formula for calculation. Specifically, the probability of each value is multiplied by its corresponding base-2 logarithm and summed to obtain a specific numerical result reflecting the randomness and disorder of the current data block. By performing this sliding truncation on the entire long byte sequence and continuously calculating the entropy value, a numerical sequence reflecting the spatial variation of the entropy value is generated, i.e., the information entropy distribution of the payload byte sequence. The scientific principle behind this processing method is that the data payload after high-strength encryption or compression obfuscation has an extremely uniform byte distribution, and its entropy value will be very close to the upper limit theoretical value of 8. In contrast, the entropy value of ordinary plaintext protocols or messages with a large number of repeated padding characters is usually lower, remaining between the values ​​of 3 and 5. By extracting and analyzing the distribution curve characteristics of this set of continuous entropy values, it is possible to effectively identify hidden encrypted communication tunnels or malicious traffic that has undergone special encoding obfuscation, thereby keenly capturing potential abnormal behavior characteristics in a fully encrypted state.

[0027] After obtaining the original protocol handshake fields and dynamic information entropy sequences, a numerical encoding process must be performed to unify the data format because data of different dimensions has completely different dimensions and representations. For discrete category information such as protocol version numbers and cipher suite identifiers, label mapping or one-hot encoding is used to convert them into numerical feature vectors of uniform length, ensuring that each specific category label can find a corresponding and unique coordinate point in the feature space. For example, the extracted multiple identifiers are mapped to a 128-dimensional numerical vector. This numerical feature vector containing static metadata is then directly integrated with the previously calculated information entropy distribution sequence reflecting the dynamic characteristics of the payload. In this specific execution process, a matrix concatenation method is used to horizontally arrange the feature sequences from two different sources according to a preset dimensional order, thereby synthesizing the originally isolated handshake features and statistical features into a complete cryptographic feature set. The reason for obtaining the final feature set through matrix concatenation is that single-dimensional features often cannot fully cover the overall characteristics of complex encrypted communication. Only by organically integrating static fingerprints describing security negotiation capabilities with dynamic statistical values ​​describing data distribution patterns can we achieve in-depth extraction and expression of encryption threat features while maintaining low computational cost. This process essentially utilizes the fundamental principle of cross-domain complementarity of multi-source features, combining deterministic protocol details with statistical payload distribution to provide a highly discriminative multi-dimensional feature matrix for accurately distinguishing between legitimate encryption behavior and illegitimate encryption attacks.

[0028] In one embodiment of the present invention, the process of numerically concatenating the interaction behavior feature vector with the cryptographic feature set in the feature tensor module to generate a global multidimensional feature tensor representing the bidirectional network session flow is as follows: After obtaining the interaction behavior feature vector and the cryptographic feature set, since these two datasets originate from completely different analytical dimensions and have vastly different numerical ranges, it is necessary to first extract the specific numerical distribution parameters of the data within these two feature sets. By calculating the arithmetic mean and standard deviation of all elements in the interaction behavior feature vector, and the maximum and minimum values ​​of each dimension in the cryptographic feature set, the inherent distribution state of these two sets of features can be accurately grasped. For example, the time interval for extracting behavioral features may have a mean of 50 and a variance of 100, while the cipher suite identifier value in the cryptographic features may be as high as 49195. Based on these calculated distribution parameters, a rigorous data scaling operation is performed on the original data using numerical formulas. The Z-score standardization method is used to subtract the mean from each element in the behavioral feature vector and then divide by the standard deviation, while the min-max normalization formula is used to compress the cryptographic feature values ​​to the range of 0 to 1. The reason for generating standardized behavioral feature vectors and standardized cryptographic feature sets by extracting distribution parameters and performing scaling operations is that the algorithm is highly sensitive to the absolute values ​​of the input data. If data of different dimensions are directly mixed, cryptographic identifiers with extremely large values ​​will completely mask the probability proportion features with extremely small values, leading to serious deviations in model weight updates. This scaling operation eliminates the dimension gap, allowing all features to express the inherent laws of network traffic at the same numerical scale, laying the data foundation for constructing a unified feature space.

[0029] After standardizing the feature values, a shape structure parsing operation is performed on the standardized behavioral feature vector and the standardized cryptographic feature set. This involves precisely obtaining the specific shape parameters of these two data sequences in memory. Due to varying complexity of network sessions, the extracted feature sequence lengths often differ. For example, the calculated length parameter of the behavioral feature vector is 64 dimensions, while the sequence length parameter of the cryptographic feature set is 128 dimensions. To enable features of different lengths to be processed within the same mathematical space, the program compares the specific values ​​of these two dimensions and selects the dimension with the largest value as the benchmark. Based on this largest shape parameter, which is 128 dimensions, a zero-padded operation is performed on the smaller feature set. In practice, 64 consecutive elements with values ​​of 0 are appended to the end of the 64-dimensional behavioral feature vector, forcibly expanding its total length to 128 dimensions, exactly equal to the cryptographic feature. The core principle behind constructing aligned behavioral feature matrices and aligned cryptographic feature matrices by comparing shape parameters and performing zero-padded operations is that matrix operations strictly depend on the symmetry and consistency of dimensions. Without dimensional alignment, tensor concatenation operations will trigger a severe shape mismatch error in the underlying computational framework. Using zeros for padding satisfies the hardware format requirements of matrix computation without introducing any noise with actual bias information into the original feature distribution, thus reliably ensuring a high degree of structural uniformity for multimodal data.

[0030] After obtaining two perfectly aligned feature matrices, the algorithm module predetermines the splicing axis direction parameter of the tensor in multidimensional space, which determines the mathematical dimension along which the matrix data will be aggregated. Typically, the splicing axis direction parameter is set to 0, indicating that the layering is performed along the outermost dimension containing the channel. Along the set tensor splicing axis direction parameter, the aligned behavioral feature matrix and the aligned cryptographic feature matrix, both with a length of 128, are tightly concatenated dimensionally. Specifically, these two 1-dimensional matrices are stacked like layers, with a new data dimension nested at the outermost layer—that is, an explicit addition of an independent channel. For example, two matrices originally of shape 1x128, after concatenation and the addition of a channel, will transform into a 3-dimensional multi-channel structure of shape 2x1x128, where 2 represents the two completely independent data channels: the behavioral feature and the cryptographic feature. The reason for generating a global multidimensional feature tensor representing the bidirectional network session flow by setting a splicing axis and adding channel dimensions is based on the mature idea of ​​handling heterogeneous information in multimodal feature learning. Placing features of different dimensions in independent channels allows the graph attention network to independently extract local patterns within specific channels during aggregation calculations, while also uncovering deep interactive relationships between behavioral patterns and cryptographic attributes across different channels. This high-dimensional tensor encapsulation perfectly preserves the original hierarchical structure of the data, providing the most complete and three-dimensional information representation for accurately determining complex network threat behaviors.

[0031] In one embodiment of the present invention, the process of constructing a network communication attribute graph in the attribute graph construction module, using the network addresses of the two communicating parties in a bidirectional network session as nodes and the global multidimensional feature tensor as edge attributes, is as follows: The network layer header information of each data packet captured by the packet capture tool is read to accurately extract the source and destination network addresses carried in the bidirectional network session stream. For example, the network address representing the attacker, 192.168.1.15, and the network address representing the victim host, 10.0.0.88, are extracted respectively. Since the same network address often participates in hundreds or thousands of concurrent session connections in massive network communications, directly using the raw data would result in significant memory waste. Therefore, a hash table mechanism is used to remove duplicates from all collected network addresses, thus establishing a global network address set without any redundancy. After obtaining this pure set, each network address in the global network address set is assigned a unique node index number according to the order in which elements entered the set or the arrangement rule of numerical value. For example, the first identified address is mapped to the number 0, the second address to the number 1, and so on, until all addresses are assigned integer labels, ultimately generating a node set of the network communication attribute graph. The reason for generating node sets by deduplication and assigning integer index numbers is that the underlying matrix operations of graph neural networks cannot directly handle network addresses in the form of strings of varying lengths. Converting them into consecutive integer indices starting from 0 not only greatly reduces memory usage, but also abstracts complex physical network nodes into graph vertex coordinates that can directly participate in tensor multiplication operations, providing the necessary mathematical mapping foundation for constructing a strict graph topology.

[0032] For each bidirectional network session flow whose network address has been extracted, its exact interaction direction is determined strictly according to the handshake rules of the underlying communication protocol. Typically, the end sending the first synchronization request message is identified as the source, and the end receiving and responding to the request is identified as the destination. After determining the absolute direction of this data interaction, the node set of the network communication attribute graph generated in the previous step is queried in memory. The node index number corresponding to the source network address is set as the edge start point, and the node index number corresponding to the destination network address is set as the edge end point. For example, if a session flow from address index 0 to address index 1 is found, a directed connection with a clear direction is established between edge start point 0 and edge end point 1. All directed connections corresponding to all session flows are combined to form a set containing all communication path topology relationships, thus generating the edge set of the network communication attribute graph. The reason for establishing a start and end point to establish directed connections and generate an edge set is that most network attacks exhibit extremely strong asymmetry and directionality. Sending commands from the Trojan control terminal to the controlled host and sending stolen data back to the control terminal are completely different threat behaviors. By using directed edges to clearly depict this communication flow radiating from the attack source to the target machine, the graph computing model can accurately capture the spatiotemporal trajectory and topological dependencies of the threat spread, so that the graph structure not only includes the existence of connections but also the intrusiveness of the connections.

[0033] After clarifying the topological connections between nodes, it is necessary to assign concrete physical communication meanings to these abstract connections. A global multidimensional feature tensor representing the bidirectional network session flow is retrieved from memory storage. This tensor contains 128 dimensions of multimodal data, including time transition ticks, payload length ratios, and protocol cryptographic features during the communication process. A strict matching and binding operation is performed between this global multidimensional feature tensor and the corresponding directed connections in the edge set. For example, for the directed connection from node number 0 to node number 1, the 128-dimensional multi-channel feature tensor belonging to this pair of communicating entities is directly attached to the attribute field of this connection, thus establishing the global multidimensional feature tensor as the exclusive edge attribute of this directed connection. This feature attachment process is repeated for all directed connections, ultimately constructing the edge attribute set of the network communication attribute graph. The reason for constructing the edge attribute set through matching and binding operations is that traditional graph structures often only concern the state of the nodes themselves. However, in the field of network traffic analysis, the nodes of the communicating parties are merely ordinary computers; the real threat information lies in the data flow transmitted between these two computers. By using tensors that integrate behavioral patterns and cryptographic features as attributes of edges, the originally empty topological edges with only connection points are instantly transformed into high-dimensional data pipelines rich in dynamic traffic characteristics, thus providing a direct numerical basis for assessing the degree of communication risk in graph attention networks.

[0034] Once the nodes, directed connections, and the features carried on those connections are all ready, an adjacency matrix reflecting the node connections is generated using the node set and edge set used to construct the network communication attribute graph. Assuming there are 100 unique nodes in the network, a 100x100 two-dimensional matrix is ​​initialized in memory. If a directed edge exists from node 5 to node 9, the element in the 5th row and 9th column of the matrix is ​​assigned a value of 1; other nodes without direct communication are assigned a value of 0. After generating this adjacency matrix that accurately represents the network's physical topology, the adjacency matrix and the edge attribute set obtained in the previous step are subjected to graph structuring encapsulation. Specifically, the encapsulation function of the graph data processing framework is used to jointly package the two-dimensional matrix representing the connection structure and the multidimensional tensor representing the connection features into a unified data object, ultimately constructing a network communication attribute graph with network addresses as nodes and global multidimensional feature tensors as edge attributes. The reason for generating the adjacency matrix and performing structuring encapsulation to construct the final attribute graph is that deep learning frameworks cannot directly receive scattered list or dictionary data. The adjacency matrix provides a routing table for information transmission in neural networks, while the edge attribute set provides the specific content to be transmitted. The standard graph structure formed by deeply encapsulating these two elements enables the graph attention algorithm module to know, when performing receptive field aggregation, which neighboring nodes to collect information from, and what degree of threat weight the data from different neighbors has.

[0035] In one embodiment of the present invention, the threat classification module performs node representation aggregation operation on the network communication attribute graph input graph attention neural network model, fuses and concatenates the aggregated node representations of the two communicating parties with the original edge attributes, generates an edge prediction vector and outputs an edge classification label, and determines the threat category as follows: The constructed network communication attribute graph is used as the underlying data source input to the graph attention neural network model for deep feature calculation. Since the network address nodes themselves do not carry features in the initial state, the model first maps the edge attribute features connected to the nodes to the node's initial representation vector. For example, the average of the 128-dimensional edge features connected to the node is taken as the node's initial state. During the core calculation process, the model traverses each target node and calculates the attention weight values ​​between the target node and all its first-order associated nodes. Specifically, the initial representation vector of the target node is concatenated with the representation vectors of the associated nodes, and then input into a single-layer feedforward neural network. An unnormalized relevance score is calculated using a linear unit activation function with leakage correction. To ensure the comparability of all weight values, an exponential normalization function is used to normalize these scores. Line compression ensures that the sum of attention weights between a node and all its associated nodes is exactly 1; for example, the weights of target node 0 with associated nodes 1 and 2 might be calculated as 0.7 and 0.3, respectively. Based on the calculated attention weights, a weighted summation aggregation operation is performed on the feature tensors of the associated nodes, which gives key nodes a higher information transmission ratio, filters out interference from noisy nodes, and finally generates the aggregated representation of the communicating parties. The reason for generating the aggregated node representation by calculating the weighted aggregation of weights is that network attacks often have group coordination characteristics. Infected hosts usually communicate frequently with specific malicious control domains. The attention mechanism can automatically capture the most threatening neighbor connections in complex network topologies, giving isolated host nodes structured features that include the global topological context.

[0036] After completing the feature aggregation operation of the graph attention layer, all nodes in the graph structure possess a deep information representation that integrates the global topology. At this point, it is necessary to accurately extract the aggregated representations of the communicating nodes to prepare for the determination of a specific session. For a directed communication link in the graph topology, based on the node index corresponding to the source network address and the node index corresponding to the destination network address, the source node representation vector and the destination node representation vector, which have undergone high-order feature aggregation, are copied from the output tensor of the graph neural network. Assuming that the extracted source node features are 64-dimensional vectors, the destination node features are also 64-dimensional vectors. To preserve the initially captured communication detail stream, the original edge attribute tensor existing between these two nodes and not yet aggregated and smoothed is retrieved again. Assuming that the original edge features are 128-dimensional vectors, the extracted source node representation and destination node representation are then processed. The representation, along with the original edge attributes directly corresponding to the two, is subjected to matrix concatenation operations along a unified feature dimension to complete data fusion and splicing. Specifically, the splicing method involves linearly tiling these three feature vectors in different dimensions in memory, combining them into a single and extremely long one-dimensional feature sequence with a total dimension length of 256, thereby completely completing the heterogeneous dimension data fusion and splicing process. The reason for using this matrix concatenation operation to complete data fusion and splicing is that simple graph node features only reflect the overall behavioral tendencies of the host, while the original edge features record the unique cryptographic fingerprint and rhythmic patterns of the session. By physically binding the macroscopic communication graph context with the microscopic single traffic characteristics, the prediction model can simultaneously possess the breadth of the full graph perspective and the accuracy of the microscopic session perspective, effectively avoiding the loss of key communication details due to over-aggregation.

[0037] The fused and concatenated feature matrix is ​​input into a multilayer perceptron for nonlinear mapping. The output numerical sequence is extracted to generate edge prediction vectors. A probability distribution function is used to perform mapping calculations on the edge prediction vectors, and the classification label of the edge corresponding to the highest probability is output. Specific content includes: The fused and stitched feature matrix with a total dimension of 256, prepared in the previous steps, is used as the underlying basic data input into the multilayer perceptron model for deep computation. This multilayer perceptron network structure includes three fully connected hidden layer node matrices. As data flows through these three hidden layers, the underlying computation framework uses a modified linear unit activation function to perform complex matrix multiplication operations on the input feature matrix and the network's own weight parameter matrix. After each matrix multiplication, the activation function immediately performs a non-linear transformation operation on the intermediate result. Specifically, all calculation results less than 0 are forcibly reset to 0, while keeping values ​​greater than 0 unchanged. The reason for processing the feature matrix in this way, combining matrix multiplication and non-linear activation, is that simple linear multiplication can only solve simple linearly separable problems; introducing non-linear transformation can forcibly distort the mathematical boundaries of the high-dimensional feature space, giving the perceptron a powerful ability to fit and distinguish extremely complex network traffic features. After the feature data passes through all hidden layers, the perceptron extracts data from the last layer without any activation function. At this point, the program directly extracts the output value sequence of the output layer. Assuming there are a total of 5 network behavior types in the current classification target, what is extracted is a one-dimensional tensor structure containing 5 arbitrary floating-point values, which is used to formally generate the edge prediction vector representing the original tendency score.

[0038] After obtaining the edge prediction vector containing five arbitrary floating-point values, it must be input into a probability distribution function for normalization. Since these absolute values ​​may be negative and their range has no fixed upper bound, human business logic cannot directly understand their precise meaning. The specific calculation process involves first extracting each floating-point element from the edge prediction vector and then using the underlying mathematical calculation library to calculate the natural exponent value of each element. Assuming the original value at a certain position in the vector is 2, the natural constant e squared is calculated to obtain an amplified value of approximately 7.38. This exponential operation not only forcibly converts all negative values ​​into positive numbers but also significantly widens the absolute difference between different values. After calculating the natural exponent values ​​of all five elements, the calculation module sums these five natural exponent values ​​to obtain a global sum base denominator. Then, the natural exponent value of a single element is divided by the sum of the natural exponent values ​​of all the elements just calculated. The reason for using division based on natural exponents to perform the mapping calculation is that this mathematical mechanism can perfectly compress any sequence of real numbers into the range of 0 and 1. This ensures that the sum of the newly generated floating-point values ​​is absolutely equal to 1. This allows for the successful acquisition of probability scores for each category, completing the mapping calculation and transforming the value of each dimension into a percentage confidence level that directly represents the likelihood of the corresponding network threat type occurring.

[0039] After the probability distribution function successfully outputs five probability percentages between 0 and 1, the decision-making program initiates a loop check logic in the memory buffer. This logic starts from the first element with an index value of 0 and iterates through all the probability scores corresponding to the calculated categories. During the iteration, the processor's internal arithmetic logic unit performs pairwise comparisons of the aforementioned probability scores. Specifically, a maximum value variable and an index variable, both initially set to 0, are pre-defined in memory. Each time a new probability score is read, it is compared with the currently stored maximum value variable. If the newly read value is larger, the new value overwrites the old maximum value, and the current index variable is updated simultaneously. Through this rigorous loop comparison mechanism, the program can accurately locate the probability score with the largest value. Suppose that after five loop comparisons, the probability score of 0.85 at the fourth position is found to be the highest score in the entire sequence, the program immediately stops comparing and extracts the category index associated with the dimension of the highest probability score. At this point, the number 4 is extracted as the final identified category feature code. The reason for generating the final result through this traversal comparison and index extraction method is that actual security defense actions can only be executed against the most likely specific threat. By eliminating all lower probability interference and retaining only the label with the highest confidence, the program can clearly output the edge classification label corresponding to the highest probability, thus providing a unique and definitive numerical basis for finally identifying and intercepting specific network attack behaviors.

[0040] Before the system is officially deployed, offline training of the graph attention neural network model and the multilayer perceptron (MLP) is required. Specifically, the system collects massive amounts of historical full-traffic mirror data with clear threat markers, calls the aforementioned traffic reconstruction, behavioral feature extraction, and cryptographic feature extraction modules to generate a network communication attribute graph dataset containing ground truth labels. These attribute graphs are then batched into the network architecture for forward propagation. After the MLP outputs the predicted probability distribution, the error between the predicted probability and the ground truth label is accurately calculated using the cross-entropy loss function. Subsequently, the gradients of the parameters of each layer within the model are calculated using the backpropagation algorithm, and an adaptive optimizer (such as the Adam optimization algorithm) is used to continuously update the attention aggregation weights of the graph attention layer and the nonlinear mapping weights of the MLP along the gradient descent direction. Through multiple epochs of iterative approximation across the entire dataset, the loss function converges to a preset minimum threshold, thus solidifying the final model parameters. The reason for performing this training process based on cross-entropy and backpropagation is that the weights in the initial state of the deep learning model are random. Only through repeated correction using a large amount of labeled data can the model automatically learn and fit a precise mathematical decision boundary that distinguishes between benign traffic and various malicious attacks in a complex high-dimensional feature space.

[0041] After the model parameters are solidified and the system is initialized, the developers will pre-create a structured mapping table in the in-memory database. This table strictly defines the correspondence between the edge classification labels (composed of numbers) and the specific network attack types that are readable by humans. For example, in this mapping table, number 0 represents normal, benign business traffic, number 1 represents botnet command and control tunnel communication, number 2 represents ransomware data outreach, number 3 represents covert encrypted port scanning, and number 4 represents the heartbeat keep-alive connection of a remote access Trojan. After the graph attention neural network and multilayer perceptron complete all forward propagation calculations and give the final conclusion, the program will directly send the obtained output edge classification labels (containing only numbers) into this mapping table to perform a high-speed hash retrieval and matching operation. Assuming that the highest probability label output in the previous step is number 4, the retrieval calculation... The algorithm quickly locates the row with key value 4 in the table and extracts the matching mapping entry, which is the string information of the remote access Trojan's heartbeat keep-alive connection. This is used as the definitive conclusion for the bidirectional network session flow, thoroughly determining the threat category of the bidirectional network session flow. The reason for determining the final threat category by establishing a mapping table and performing a retrieval comparison is that the underlying hardware of deep learning can only understand and efficiently process pure numerical encoding in matrix format, and cannot directly output text descriptions with business semantics. By using a static dictionary mapping table to perfectly translate the underlying mathematical tensor prediction results into the top-level network security alert language, not only is the model operation logic and business display logic completely decoupled, greatly improving the running efficiency of the inference code, but it also enables security analysis and maintenance personnel to intuitively understand the alert content and quickly take protective measures such as blocking and isolation.

[0042] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the claims of this invention should still fall within the patent coverage of this invention.

Claims

1. A network threat perception system based on full flow mirroring analysis, characterized in that, include: The traffic reassembly module is used to receive full traffic mirror data, sequentially perform network layer fragmentation reassembly and transport layer TCP stream reassembly, establish bidirectional network session streams, extract payload characteristics, and retain protocol control messages. The behavior feature module is used to calculate the transition matrix of the packet arrival time interval in the bidirectional network session flow and generate the interactive behavior feature vector of the bidirectional byte length distribution of the packets. The cryptographic feature module is used to extract data packet feature fields from the initial interaction phase of the bidirectional network session stream and construct a cryptographic feature set by combining the information entropy distribution of the payload byte sequence in the bidirectional network session stream. The feature tensor module is used to numerically concatenate the interactive behavior feature vector with the cryptographic feature set to generate a global multidimensional feature tensor representing the bidirectional network session flow. The attribute graph construction module is used to construct a network communication attribute graph with the network addresses of the two communicating parties in a bidirectional network session as nodes and global multidimensional feature tensors as edge attributes. The threat classification module is used to input the network communication attribute graph into the graph attention neural network model to perform node representation aggregation operations, fuse and splice the aggregated node representations of the two communicating parties with the original edge attributes, generate edge prediction vectors and output edge classification labels to determine the threat category.

2. The network threat perception system based on full flow mirroring analysis according to claim 1, characterized in that, In the traffic reassembly module, the process of receiving full traffic mirror data, sequentially performing network layer fragmentation reassembly and transport layer TCP stream reassembly, establishing a bidirectional network session stream, extracting payload features, and retaining protocol control messages is as follows: Receive full traffic mirror data, parse the identifier and fragment offset in the network layer header, and concatenate fragmented packets with the same identifier according to the fragment offset order to complete the network layer fragmentation and reassembly. Parse the transport layer header of the reassembled message, construct a communication 5-tuple using the network address and TCP port, combine messages belonging to the same communication 5-tuple according to the sequence number, establish a bidirectional network session stream, and complete the transport layer TCP stream reassembly. The header of packets in the bidirectional network session stream is stripped and the data area is truncated to extract payload characteristics. Packets that lack data area and only carry TCP flags are retained as protocol control packets.

3. The network threat perception system based on full flow mirroring analysis according to claim 1, characterized in that, In the behavior feature module, the process of calculating the transition matrix of the packet arrival time interval in the bidirectional network session flow and generating the interactive behavior feature vector of the bidirectional byte length distribution of the packets is as follows: Extract the arrival timestamp difference of adjacent packets in the bidirectional network session flow to construct a time interval sequence, and discretize the time interval sequence according to the numerical range to map it into a time state sequence; The transition frequency of adjacent time states in the statistical time state sequence is calculated, the proportion of each transition frequency to the total transition frequency is calculated, and a transition matrix of the packet arrival time interval in the bidirectional network session flow is constructed. Extract the payload byte lengths of forward and reverse packets in the bidirectional network session stream and calculate the frequency ratio. Combine this with the transition matrix to generate an interactive behavior feature vector of the bidirectional byte length distribution of packets.

4. The network threat perception system based on full flow mirroring analysis according to claim 1, characterized in that, In the cryptographic feature module, the process of extracting data packet feature fields from the initial interaction phase of the bidirectional network session stream and constructing a cryptographic feature set by combining the information entropy distribution of the payload byte sequence in the bidirectional network session stream is as follows: Capture the handshake negotiation message during the initial interaction phase of the bidirectional network session flow, and extract the protocol version number, cipher suite identifier, and extended parameter length from the handshake negotiation message as data packet feature fields; The payload byte sequence of the bidirectional network session stream is truncated by a fixed step size and window. The Shannon information entropy of the frequency of byte values ​​in each truncation window is calculated to generate the information entropy distribution of the payload byte sequence. Numerical encoding is performed on the data packet feature fields to generate a numerical feature vector. This numerical feature vector is then concatenated with the information entropy distribution of the payload byte sequence to construct the cryptographic feature set of the bidirectional network session stream.

5. The network threat perception system based on full flow mirroring analysis according to claim 1, characterized in that, In the feature tensor module, the process of numerically concatenating the interaction behavior feature vector with the cryptographic feature set to generate a global multidimensional feature tensor representing the bidirectional network session flow is as follows: Extract the numerical distribution parameters of the interaction behavior feature vector and the cryptographic feature set, and perform data scaling operations based on the numerical distribution parameters to generate standardized behavior feature vectors and standardized cryptographic feature sets; Obtain the shape parameters of the standardized behavioral feature vector and the standardized cryptographic feature set, and perform zero-padded operation on the two based on the maximum shape parameter to construct the aligned behavioral feature matrix and the aligned cryptographic feature matrix; Determine the tensor splicing axis direction parameter, perform data concatenation of the alignment behavior feature matrix and the alignment cryptographic feature matrix along the tensor splicing axis direction parameter, and add channel dimension to generate a global multidimensional feature tensor representing the bidirectional network session flow.

6. The network threat perception system based on full flow mirroring analysis according to claim 1, wherein, In the attribute graph construction module, the process of constructing a network communication attribute graph using the network addresses of the two communicating parties in a bidirectional network session as nodes and the global multidimensional feature tensor as edge attributes is as follows: Extract the source and destination network addresses from the bidirectional network session flow, remove duplicate network addresses to establish a global network address set, assign a unique node index number to each network address in the global network address set, and generate a node set for the network communication attribute graph. Based on the interaction direction of the bidirectional network session flow, the node index number corresponding to the source network address is set as the edge start point, and the node index number corresponding to the destination network address is set as the edge end point. A directed connection is established between the edge start point and the edge end point to generate the edge set of the network communication attribute graph. Retrieve the global multidimensional feature tensor representing the bidirectional network session flow, perform matching and binding between the global multidimensional feature tensor and the corresponding directed connection in the edge set, establish the global multidimensional feature tensor as the edge attribute of the directed connection, and construct the edge attribute set of the network communication attribute graph. The node set and edge set of the network communication attribute graph are constructed to generate an adjacency matrix that reflects the connection relationship between nodes. The adjacency matrix and the edge attribute set are encapsulated in a graph structure to construct a network communication attribute graph with network addresses as nodes and global multidimensional feature tensors as edge attributes.

7. The network threat perception system based on full flow mirroring analysis according to claim 1, characterized in that, In the threat classification module, the process of generating edge prediction vectors and outputting edge classification labels to determine the threat category is as follows: The network communication attribute graph is input into the graph attention neural network model, the attention weights of nodes and their associated nodes are calculated, and the weighted aggregation operation is performed on the features of associated nodes based on the weights to generate the aggregated node representations of the two communicating parties. Extract the aggregated node representations of the two communicating parties, and perform matrix concatenation operations along the same feature dimension on the source node representation, the destination node representation, and the corresponding original edge attributes between them to complete the data fusion and splicing, and obtain the feature matrix. The fused and spliced ​​feature matrix is ​​input into a multilayer perceptron to perform nonlinear mapping, the output numerical sequence is extracted to generate edge prediction vectors, the probability distribution function is used to perform mapping calculations on the edge prediction vectors, and the edge classification label corresponding to the highest probability is output. Establish a mapping table between edge classification labels and network attack types. Perform a search and matching on the output edge classification labels in this mapping table, extract the content of matching mapping entries, and determine the threat category of the bidirectional network session flow.

8. The network threat perception system based on full flow mirroring analysis according to claim 7, characterized in that, The specific method for performing mapping calculations on the edge prediction vector using a probability distribution function and outputting the edge classification label corresponding to the highest probability is as follows: The fused and spliced ​​feature matrix is ​​input into a multilayer perceptron. In the hidden layer, the activation function is used to perform matrix multiplication and nonlinear transformation on the feature matrix. The output value sequence of the output layer is extracted to generate the edge prediction vector. Input the edge prediction vector into the probability distribution function, calculate the natural index value of each element in the edge prediction vector, divide the natural index value of a single element by the sum of the natural index values ​​of all elements, and obtain the probability score corresponding to each category to complete the mapping calculation. Iterate through all the probability scores corresponding to the categories generated by the mapping calculation, perform a numerical comparison operation on the aforementioned probability scores, locate the probability score with the largest value, extract the category index associated with the dimension of the largest probability score, and output the edge classification label corresponding to the largest probability.

Images