A network security traffic feature compensation identification method based on a graph neural network
By constructing dynamic heterogeneous graphs and graph neural networks, and combining them with sparse baselines for feature compensation and anomaly detection, a virtual network function management strategy is generated. This solves the problems of feature loss and fragmented detection results in large-scale network environments, and achieves efficient threat identification and real-time response.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- XIANYANG NORMAL UNIV
- Filing Date
- 2026-04-10
- Publication Date
- 2026-07-10
AI Technical Summary
Existing network security traffic detection technologies suffer from feature loss issues in large-scale network environments, making it difficult to identify encrypted traffic and multi-hop attacks. Furthermore, the detection results are disconnected from response strategy deployment, failing to form an automated closed loop.
By constructing a dynamic heterogeneous graph and performing feature compensation processing, nodes are mapped to a three-dimensional coordinate space. Anomaly detection is performed by combining graph neural networks and sparse baselines, and a virtual network function management strategy is generated to achieve an automated closed loop of detection and response.
It improves the accuracy of identifying encrypted traffic and multi-hop attacks, reduces GNN inference latency, realizes real-time automation of detection results and policy deployment, and enhances the proactive defense capabilities of network security.
Smart Images
Figure CN122372262A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of information engineering technology, and more specifically, to a network security traffic feature compensation and identification method based on graph neural networks. Background Technology
[0002] Graph Neural Networks (GNNs) are deep learning models capable of directly processing graph-structured data and have been widely applied in the field of cybersecurity in recent years. By modeling network devices and their communication relationships as a graph structure, GNNs can effectively capture network topology information and the interaction behavior between nodes, providing a new technical approach for tasks such as anomaly detection and attack attribution. In network traffic analysis, commonly used security detection methods include rule-based feature matching, statistical baseline learning, and deep learning-based traffic classification.
[0003] However, existing network security traffic detection technologies still have the following shortcomings: traffic data in large-scale network environments suffers from severe feature loss, such as encrypted traffic making payload information invisible and packet loss during sampling resulting in incomplete temporal features, making it difficult for traditional detection methods to accurately identify threats under feature loss conditions; existing GNN detection methods do not fully consider the impact of network topology on node behavior and lack the ability to model long-term changes in node communication patterns, making it difficult to effectively detect covert communication and multi-hop attacks; GNN models have computational efficiency bottlenecks when processing large-scale graph data, and preprocessing and inference delays are difficult to meet real-time detection requirements, and there is a disconnect between detection results and network policy deployment, making it impossible to form an automated closed loop of detection-response.
[0004] Therefore, there is an urgent need to provide a network security traffic feature compensation and identification method based on graph neural networks to solve the above-mentioned technical problems. Summary of the Invention
[0005] The purpose of this invention is to provide a network security traffic feature compensation and identification method based on graph neural networks, so as to solve the technical problem that existing technologies cannot build a complete detection-response closed-loop system.
[0006] To achieve the above objectives, the following solution is proposed: A network security traffic feature compensation and identification method based on graph neural networks includes: Obtain network traffic data to be tested; The network traffic data to be tested is preprocessed to extract key attributes of traffic events. The key attributes include at least one of time information, protocol number, destination IP address, and destination port number. A dynamic heterogeneous graph is constructed based on the key attributes, wherein the vertices of the dynamic heterogeneous graph are network nodes and the edges are communication behaviors; The dynamic heterogeneous graph is subjected to feature compensation processing, which maps the nodes in the dynamic heterogeneous graph to a three-dimensional coordinate space and compensates for the missing feature dimensions. The feature-compensated dynamic heterogeneous graph is input into the graph neural network model to generate node state information for each node. Based on the comparison between the node status information and the preset sparsity baseline, it is determined whether the communication behavior of each node deviates from the baseline, and an anomaly score is output. A virtual network function management strategy is generated based on the anomaly score, and the virtual network function management strategy is deployed to the target node.
[0007] Further, mapping the nodes in the dynamic heterogeneous graph to a three-dimensional coordinate space includes: Calculate the angular coordinates based on the host portion of the destination IP address; Calculate the radius coordinates based on communication frequency and time attenuation weights; Calculate the height coordinates based on the network portion of the destination IP address; The compensation for missing feature dimensions includes: Detect whether there are missing feature dimensions in the nodes of the dynamic heterogeneous graph; If any feature dimensions are missing, the feature information of neighboring nodes is aggregated and compensated for based on time decay weights. in, The node features are after compensation. Let V be the set of neighboring nodes of node V, and wt be the time decay weight.
[0008] Furthermore, the graph neural network model adopts a target vertex-centric computational paradigm, where each node aggregates feature information from its neighboring nodes to update its node state: in, Let AGG be the state of node v at level k, and let AGG be the aggregation function. For activation functions; The preset sparsity baseline is constructed in the following way: Calculate the number of times each node accesses each network object, where the network object includes at least one of domain name, IP address, and application information; The calculated number of accesses is stored in the database to form an access frequency baseline; The current communication access frequency is compared with the baseline. If the deviation exceeds a preset threshold, it is determined to be a sparsity anomaly.
[0009] Furthermore, the anomaly score is calculated using the following formula: in, For node status information, The deviation value from the sparsity baseline, For time entropy, , , These are weighting coefficients; The virtual network function management strategy includes at least one of creating, maintaining, or deleting virtual network functions; The virtual network functionality includes at least one of the following: firewall, intrusion detection system, network address translation, and traffic mirroring.
[0010] Furthermore, before inputting the feature-compensated dynamic heterogeneous graph into the graph neural network model, a GNN inference acceleration step is included: All feature dimensions of the target node are bound to the same streaming multiprocessor, and the number of streaming multiprocessors allocated is: N SM = in, Tmax is the number of feature dimensions, and Tmax is the maximum number of threads in a streaming multiprocessor. Obtain a data flow graph, which includes embedded accumulation nodes and transformation nodes; The gain of different execution orders is evaluated at runtime using a cost model, which approximates the execution time based on the dimensionality reduction factor of the input tensor and the kernel execution factor. The execution order with the higher gain is selected for embedding accumulation and transformation.
[0011] Furthermore, the deployment of the virtual network function management policy to the target node includes: The node status information is concatenated with the service list data to generate an input vector. The service list data includes at least one of the following: starting node, destination node, service type, and quality requirements. The input vector is input into the feedforward neural network, which outputs a virtual network function management strategy. The virtual network function management policy is deployed to the target node using an NFV orchestrator. When the input vector is input into the feedforward neural network, if the number of data in the first class is less than the number of data in the second class, the learning weight assigned to the first class is set to be greater than the learning weight assigned to the second class.
[0012] Furthermore, it also includes: Collect traffic change data and detection results after the deployment of virtual network function management policies; The graph neural network model is incrementally trained based on the collected data, and the model parameters are updated.
[0013] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. Dynamic compensation of traffic features is achieved through three-dimensional coordinate mapping and a neighbor feature aggregation mechanism. Specifically, nodes are mapped to a three-dimensional coordinate space, with the angle determined by the IP host portion, the radius by the communication frequency and time decay weight, and the height by the IP network portion. When a missing feature dimension is detected, the feature information of neighboring nodes is aggregated according to the time decay weight for compensation. This effectively solves the detection failure problem caused by missing features in scenarios such as encrypted traffic and sampling packet loss, and improves the robustness and accuracy of threat detection. 2. An anomaly detection mechanism combining a target vertex-centered graph neural network with sparse baseline learning effectively identifies covert communication and multi-hop attacks. Specifically, each node aggregates the feature information of its neighbors to update its node state, while simultaneously constructing a baseline of the frequency of node access to various network objects. By comprehensively considering node state, baseline deviation, and time entropy, an anomaly score is calculated, which can accurately capture abnormal communication that deviates from normal behavior patterns, overcoming the problem of insufficient utilization of network topology in traditional methods. 3. By employing inference acceleration techniques such as SM feature binding scheduling, dynamic kernel placement, and preprocessing parallelization, the inference latency of GNNs under large-scale graph data is significantly reduced. Specifically, all feature dimensions of the target node are bound to the same streaming multiprocessor. At runtime, a cost model is used to evaluate the gains of different execution orders and select the optimal execution order. Meanwhile, the preprocessing component is divided into subtasks for parallel execution, meeting the real-time detection requirements in high-throughput network environments. 4. By automatically converting anomaly detection results into Virtual Network Function Management (NFV) policies and deploying them to target nodes, an automated closed-loop detection and response system is achieved. Specifically, node status information and service list data are concatenated and input into a feedforward neural network, which outputs NFV policies. These policies are then automatically deployed to target nodes via an NFV orchestrator, reducing response time from minutes to seconds. This solves the problem of the disconnect between detection results and policy deployment, and enhances the proactive defense capabilities of network security.
[0014] On the other hand, this application also provides a network security traffic feature compensation and identification system based on graph neural networks, including: a traffic acquisition unit for acquiring network traffic data to be tested; The preprocessing unit is used to preprocess the network traffic data to be tested and extract key attributes of the traffic events. The key attributes include at least one of time information, protocol number, destination IP address, and destination port number. Graph construction unit, used to construct a dynamic heterogeneous graph based on the key attributes, wherein the vertices of the dynamic heterogeneous graph are network nodes and the edges are communication behaviors; The feature compensation unit is used to perform feature compensation processing on the dynamic heterogeneous graph, map the nodes in the dynamic heterogeneous graph to a three-dimensional coordinate space, and compensate for the missing feature dimensions. The graph neural network learning unit is used to input the feature-compensated dynamic heterogeneous graph into the graph neural network model to generate the node state information of each node. An anomaly detection unit is used to compare the node status information with a preset sparsity baseline to determine whether the communication behavior of each node deviates from the baseline and output an anomaly score. The strategy generation and deployment unit is used to generate a virtual network function management strategy based on the anomaly score and deploy the virtual network function management strategy to the target node.
[0015] Furthermore, the feature compensation unit includes: The coordinate mapping module is used to calculate the angular coordinates based on the host portion of the destination IP address, the radius coordinates based on the communication frequency and time attenuation weight, and the height coordinates based on the network portion of the destination IP address. The missing feature detection module is used to detect whether there are missing feature dimensions in the nodes of the dynamic heterogeneous graph. The neighbor aggregation compensation module is used to compensate for missing feature dimensions by aggregating the feature information of neighbor nodes based on time decay weights.
[0016] Furthermore, the anomaly detection unit includes: The baseline building module is used to calculate the number of times each node accesses each network object, forming an access frequency baseline. The deviation judgment module is used to compare the current communication access frequency with the baseline. If the deviation exceeds a preset threshold, it is judged as a sparsity anomaly. The scoring calculation module is used to calculate anomaly scores based on node status information, deviation from the sparsity baseline, and time entropy.
[0017] It is understandable that the beneficial effects of this system are the same as those of the methods described above, and will not be repeated here. Attached Figure Description
[0018] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1A flowchart illustrating the network security traffic feature compensation and identification method based on graph neural networks provided in this embodiment of the invention; Figure 2 A schematic diagram of the modules of the network security traffic feature compensation and identification system based on graph neural network provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of GNN calculation centered on the target vertex in the network security traffic feature compensation and identification method based on graph neural networks provided in an embodiment of the present invention. Detailed Implementation
[0019] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the disclosure to those skilled in the art. It should be noted that, unless otherwise specified, embodiments and features in the embodiments of the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.
[0020] Figure 1 A flowchart of a network security traffic feature compensation and identification method based on graph neural networks is provided for embodiments of this application. The method may include the following steps: Step S100: Obtain network traffic data to be tested.
[0021] Specifically, network traffic data can be data packets captured on network devices (such as routers, switches, and firewalls), traffic log files, or historical traffic data read from a traffic storage system. The network traffic data to be tested can be obtained through various means, such as real-time collection via network traffic mirroring ports, reading stored PCAP files, or obtaining standardized traffic records from a security information and event management platform.
[0022] Step S110: Preprocess the network traffic data to be tested and extract the key attributes of the traffic events.
[0023] Specifically, the acquired network traffic data is parsed to extract key attributes for each traffic event. These key attributes include at least one of the following: time information (time stamp of the traffic occurrence), protocol number (such as TCP, UDP, ICMP, etc.), destination IP address, and destination port number. For TCP / IP traffic, information such as source IP address, source port number, packet length, and flag bits can also be extracted. During preprocessing, the data can be cleaned to remove invalid or incomplete traffic records, and timestamps can be standardized to a standard format.
[0024] Step S120: Construct a dynamic heterogeneous graph based on the key attributes.
[0025] Specifically, the extracted key attributes are mapped to graph structure data. The vertices of the dynamic heterogeneous graph are network nodes (e.g., IP addresses, MAC addresses, or device identifiers), and the edges represent communication behaviors (i.e., traffic interaction between two nodes). The edge weights can be set according to communication frequency, data transmission volume, or time interval. Since the network topology changes dynamically over time, this graph structure can be dynamically updated according to time windows (e.g., every minute, every hour), forming a temporal graph sequence.
[0026] Step S130: Perform feature compensation processing on the dynamic heterogeneous graph.
[0027] This step further includes the following sub-steps: Step S131: Map the nodes in the dynamic heterogeneous graph to a three-dimensional coordinate space.
[0028] Specifically, to eliminate the problem of overlapping connections in high-traffic scenarios, each node is mapped to a three-dimensional cylindrical coordinate system. The angular coordinates are calculated based on the host portion of the destination IP address. This ensures that the host address space is evenly distributed across a 360-degree circle; the radius coordinates are calculated based on communication frequency and time attenuation weights: r = ;in, The time difference from the current time is λ, where λ is the attenuation coefficient; the altitude coordinates are calculated based on the network portion of the destination IP address. This causes nodes in the same network segment to cluster in the height direction.
[0029] Step S132: Detect whether there are missing feature dimensions in the nodes of the dynamic heterogeneous graph.
[0030] Specifically, an integrity check is performed on the feature vector of each node. Common reasons for missing features include: encrypted traffic making payload information invisible, packet loss during sampling resulting in incomplete temporal features, or newly emerging nodes not yet accumulating sufficient historical data. If a feature dimension is detected to be NULL or a default value, it is marked as a missing feature.
[0031] Step S133: If there are missing feature dimensions, the feature information of neighboring nodes is aggregated according to the time decay weight to compensate for them.
[0032] Specifically, for a node v with missing features, feature information is obtained from its set of neighboring nodes N(v), and weighted aggregation compensation is performed according to time decay weights: in, The node features are after compensation. Features of neighboring nodes The time decay weight is Δt, which is the difference between the last occurrence time of a neighboring node and the current time. In this way, the behavioral characteristics of neighboring nodes in the network topology are used to infer and compensate for missing information, improving feature completeness.
[0033] Step S140: Input the feature-compensated dynamic heterogeneous graph into the graph neural network model to generate node state information for each node.
[0034] For details, please refer to Figure 3 It can be seen that a graph neural network computation paradigm centered on the target vertex is adopted. Each node aggregates the feature information of its neighboring nodes to update the node state: ; in, Let W be the state of node v at level k, AGG be the aggregation function (which can be summation, average, or maximum aggregation). agg and W self σ is a learnable weight matrix, and σ is an activation function (such as ReLU). After multiple iterations, the node state information incorporates the behavioral features of its multi-hop neighbors, thus characterizing the node's network behavior pattern. Graph neural network models can be implemented using specific methods such as Graph Convolutional Networks (GCN), Graph Attention Networks (GAT), or Graph Sampling Aggregation Networks (GraphSAGE).
[0035] Step S150: Based on the node status information, compare it with the preset sparsity baseline to determine whether the communication behavior of each node deviates from the baseline, and output an anomaly score.
[0036] Specifically, a sparsity baseline is pre-built. The baseline building process includes: calculating the number of times each node accesses each network object, where the network object includes at least one of domain names, IP addresses, and application information; storing the calculated access counts in a database to form an access frequency baseline. For example, for node A, its normal behavior pattern might be accessing a specific list of domain names (such as internal company domain names) several times per hour. If node A accesses a domain name that has never appeared before at a certain moment, it is determined to have deviated from the baseline.
[0037] Anomaly scores are calculated using the following formula: in, This is the node state information (output by the GNN model). The deviation value from the sparsity baseline (the difference between the current access pattern and the historical baseline). α is the time entropy (used to measure the temporal regularity of node communication behavior), and β and γ are weighting coefficients. The higher the anomaly score, the more suspicious the node's communication behavior. When the anomaly score exceeds a preset threshold, an anomaly alarm is output, and the threat type is labeled. The threat type includes at least one of C2 communication, data transmission, lateral movement, and scanning detection.
[0038] Step S160: Generate a virtual network function management strategy based on the anomaly score, and deploy the virtual network function management strategy to the target node.
[0039] This step further includes the following sub-steps: Step S161: Concatenate the node status information with the service list data to generate an input vector.
[0040] Specifically, service list data is obtained, which includes at least one of the following: originating node, destination node, service type, and quality requirements (such as maximum allowable latency and required bandwidth). The service list data can originate from user service requests or service chain information from the network orchestrator. Node status information is concatenated with the service list data through a connection layer to form an input vector.
[0041] Step S162: Input the input vector into the feedforward neural network and output the virtual network function management strategy.
[0042] Specifically, the feedforward neural network (FNN) includes an input layer, at least one hidden layer, and an output layer. The input layer receives a concatenated input vector, the hidden layer extracts features through nonlinear transformations, and the output layer uses a softmax activation function to output the management policy category for each virtual network function (VNF). The virtual network function management policy includes at least one of creating, maintaining, or deleting virtual network functions. The virtual network functions include at least one of firewalls, intrusion detection systems (IDS), network address translation (NAT), and traffic mirroring. During FNN training, if the number of data points in the first class is less than the number of data points in the second class, the learning weight assigned to the first class is set to be greater than the learning weight assigned to the second class to overcome the class imbalance problem.
[0043] Step S163: Deploy the virtual network function management policy to the target node through the NFV orchestrator.
[0044] Specifically, the VNF management policies output by the FNN are converted into a command format recognizable by the NFV orchestrator. The corresponding API interfaces are then called through the NFV orchestrator (such as OpenStack Tacker, ONAP, etc.) to instantiate, configure, or remove specified VNF instances on the target node. The deployment process is typically completed within seconds, achieving an automated closed loop from detection to response.
[0045] Step S170: Collect traffic change data and detection result data after the deployment of the virtual network function management strategy, and perform incremental training on the graph neural network model based on the collected data to update the model parameters.
[0046] Specifically, after strategy deployment, subsequent traffic data, detection results (including false positives and false negatives), and strategy execution effectiveness are continuously collected. The collected data is used as new training samples to incrementally train the graph neural network model and the feedforward neural network model. Incremental training can employ mini-batch gradient descent to periodically update model parameters, enabling the model to adapt to changes in network behavior and continuously improve detection accuracy.
[0047] In some embodiments of this application, to further improve GNN inference efficiency, a GNN inference acceleration step is included before inputting the feature-compensated dynamic heterogeneous graph into the graph neural network model. Specifically: Step S180: Bind all feature dimensions of the target node to the same streaming multiprocessor.
[0048] Specifically, during GNN computation, all feature dimensions of the same target node are distributed across the same streaming multiprocessor (SM) for processing. The number of streaming multiprocessors allocated is as follows: N SM = in, Where T is the feature dimension and Tmax is the maximum number of threads in the streaming multiprocessor. This binding scheduling method avoids the repeated copying of feature data of the same node between multiple SMs, effectively reducing cache pollution and the number of global memory accesses.
[0049] Step S190: At runtime, use the cost model to evaluate the gain of different execution orders, and select the execution order with the greater gain for embedding accumulation and transformation.
[0050] Specifically, a data flow graph is obtained, which includes embedded accumulation nodes and transformation nodes. At runtime, a cost model is used to evaluate the execution time gain for two execution orders (accumulation before transformation, and transformation before accumulation). The cost model approximates the execution time based on the dimensionality reduction factor of the input tensor and the kernel execution factor. ; in, Here, represents the dimensions of the input and output tensors, and `mem_access` represents the memory access overhead. The execution order with shorter prediction execution time is selected for embedding accumulation and transformation, thereby reducing overall computational latency.
[0051] Step S200: Divide the preprocessing component into subtasks and schedule the subtasks to be executed in parallel according to the type and interdependence of the input and output data.
[0052] Specifically, the preprocessing components are divided into at least one subtask for each layer of the graph neural network. These preprocessing components include at least one of graph sampling, graph re-indexing, embedding lookup, and data migration. Subtasks are scheduled for sequential or parallel execution based on the type of input and output data (e.g., subgraph data or embedding data) and the dependencies between subtasks. When accessing shared resources (e.g., hash tables), the sampling subtask is divided into an algorithm execution part and a hash table update part. The hash table update part is executed sequentially first to avoid lock contention, and then the algorithm execution part is parallelized. By using pipelined parallelism, the execution times of the embedding lookup and data migration subtasks are overlapped, thereby reducing end-to-end preprocessing latency.
[0053] The network security traffic feature compensation and identification system based on graph neural networks provided in the embodiments of this application is described below. The system described below and the method described above can be referred to each other.
[0054] See Figure 2 , Figure 2 A schematic diagram of a network security traffic feature compensation and identification system based on graph neural networks is provided for embodiments of this application. The system may include: Traffic acquisition unit 10 is used to acquire network traffic data to be tested; The preprocessing unit 20 is used to preprocess the network traffic data to be tested and extract key attributes of traffic events. The key attributes include at least one of time information, protocol number, destination IP address, and destination port number. Graph construction unit 30 is used to construct a dynamic heterogeneous graph based on the key attributes, wherein the vertices of the dynamic heterogeneous graph are network nodes and the edges are communication behaviors; The feature compensation unit 40 is used to perform feature compensation processing on the dynamic heterogeneous graph, map the nodes in the dynamic heterogeneous graph to a three-dimensional coordinate space, and compensate for the missing feature dimensions. The graph neural network learning unit 50 is used to input the feature-compensated dynamic heterogeneous graph into the graph neural network model to generate node state information for each node. Anomaly detection unit 60 is used to compare the node status information with a preset sparsity baseline to determine whether the communication behavior of each node deviates from the baseline and output an anomaly score. The strategy generation and deployment unit 70 is used to generate a virtual network function management strategy based on the anomaly score and deploy the virtual network function management strategy to the target node.
[0055] Optionally, the feature compensation unit 40 includes: The coordinate mapping module is used to calculate the angular coordinates based on the host portion of the destination IP address, the radius coordinates based on the communication frequency and time attenuation weight, and the height coordinates based on the network portion of the destination IP address. The missing feature detection module is used to detect whether there are missing feature dimensions in the nodes of the dynamic heterogeneous graph. The neighbor aggregation compensation module is used to compensate for missing feature dimensions by aggregating the feature information of neighbor nodes based on time decay weights.
[0056] Optionally, the anomaly detection unit 60 includes: The baseline building module is used to calculate the number of times each node accesses each network object, forming an access frequency baseline. The deviation judgment module is used to compare the current communication access frequency with the baseline. If the deviation exceeds a preset threshold, it is judged as a sparsity anomaly. The scoring calculation module is used to calculate anomaly scores based on node status information, deviation from the sparsity baseline, and time entropy.
[0057] Optionally, the system further includes a GNN inference acceleration unit 80, which includes: The SM scheduling module is used to bind all feature dimensions of a target node to the same streaming multiprocessor; The dynamic kernel placement module is used to evaluate the gains of different execution orders at runtime using a cost model, and select the execution order with the greater gain for embedding accumulation and transformation; The preprocessing scheduling module is used to divide the preprocessing components into subtasks and schedule the subtasks to be executed in parallel according to the type and interdependence of the input and output data.
[0058] Optionally, the policy generation and deployment unit 70 includes: The data splicing module is used to splice the node status information with the service list data to generate an input vector; The FNN decision module is used to input the input vector into the feedforward neural network and output the virtual network function management strategy. The deployment and execution module is used to deploy the virtual network function management policy to the target node through the NFV orchestrator.
[0059] Optionally, the FNN decision module further includes a weight adjustment unit, which is used to set the learning weight assigned to the first type of data to be greater than the learning weight assigned to the second type of data when the number of first type of data is less than the number of second type of data.
[0060] Optionally, the system further includes a feedback collection unit 90 and an incremental training unit 100. The feedback collection unit 90 is used to collect traffic change data and detection result data after the deployment of the virtual network function management strategy; the incremental training unit 100 is used to incrementally train the graph neural network model based on the collected data and update the model parameters.
[0061] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program goods according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart. Figure 1 One or more processes and / or boxes Figure 1 A system that specifies functions in one or more boxes.
[0062] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including an instruction set implemented in a process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0063] These computer program instructions can also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0064] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the claims of the present invention.
Claims
1. A network security traffic feature compensation and identification method based on graph neural networks, characterized in that, include: Obtain network traffic data to be tested; The network traffic data to be tested is preprocessed to extract key attributes of traffic events. The key attributes include at least one of time information, protocol number, destination IP address, and destination port number. A dynamic heterogeneous graph is constructed based on the key attributes, wherein the vertices of the dynamic heterogeneous graph are network nodes and the edges are communication behaviors; The dynamic heterogeneous graph is subjected to feature compensation processing, which maps the nodes in the dynamic heterogeneous graph to a three-dimensional coordinate space and compensates for the missing feature dimensions. The feature-compensated dynamic heterogeneous graph is input into the graph neural network model to generate node state information for each node. Based on the comparison between the node status information and the preset sparsity baseline, it is determined whether the communication behavior of each node deviates from the baseline, and an anomaly score is output. A virtual network function management strategy is generated based on the anomaly score, and the virtual network function management strategy is deployed to the target node.
2. The network security traffic feature compensation and identification method based on graph neural networks according to claim 1, characterized in that, The step of mapping the nodes in the dynamic heterogeneous graph to a three-dimensional coordinate space includes: Calculate the angular coordinates based on the host portion of the destination IP address; Calculate the radius coordinates based on communication frequency and time attenuation weights; Calculate the height coordinates based on the network portion of the destination IP address; The compensation for missing feature dimensions includes: Detect whether there are missing feature dimensions in the nodes of the dynamic heterogeneous graph; If any feature dimensions are missing, the feature information of neighboring nodes is aggregated and compensated for based on time decay weights. in, The node features are after compensation. Let V be the set of neighboring nodes of node V, and wt be the time decay weight.
3. The network security traffic feature compensation and identification method based on graph neural networks according to claim 1, characterized in that, The graph neural network model adopts a target vertex-centered computational paradigm, where each node aggregates feature information from its neighboring nodes to update its state. in, Let AGG be the state of node v at level k, and let AGG be the aggregation function. For activation functions; The preset sparsity baseline is constructed in the following way: Calculate the number of times each node accesses each network object, where the network object includes at least one of domain name, IP address, and application information; The calculated number of accesses is stored in the database to form an access frequency baseline; The current communication access frequency is compared with the baseline. If the deviation exceeds a preset threshold, it is determined to be a sparsity anomaly.
4. The network security traffic feature compensation and identification method based on graph neural networks according to claim 1, characterized in that, The anomaly score is calculated using the following formula: in, For node status information, The deviation value from the sparsity baseline, For time entropy, , , These are weighting coefficients; The virtual network function management strategy includes at least one of creating, maintaining, or deleting virtual network functions; The virtual network functionality includes at least one of the following: firewall, intrusion detection system, network address translation, and traffic mirroring.
5. The network security traffic feature compensation and identification method based on graph neural networks according to claim 1, characterized in that, Before inputting the feature-compensated dynamic heterogeneous graph into the graph neural network model, a GNN inference acceleration step is also included: All feature dimensions of the target node are bound to the same streaming multiprocessor, and the number of streaming multiprocessors allocated is: N SM = in, Tmax is the number of feature dimensions, and Tmax is the maximum number of threads in a streaming multiprocessor. Obtain a data flow graph, which includes embedded accumulation nodes and transformation nodes; The gain of different execution orders is evaluated at runtime using a cost model, which approximates the execution time based on the dimensionality reduction factor of the input tensor and the kernel execution factor. The execution order with the higher gain is selected for embedding accumulation and transformation.
6. The network security traffic feature compensation and identification method based on graph neural networks according to claim 1, characterized in that, The process of deploying the virtual network function management policy to the target node includes: The node status information is concatenated with the service list data to generate an input vector. The service list data includes at least one of the following: starting node, destination node, service type, and quality requirements. The input vector is input into the feedforward neural network, which outputs a virtual network function management strategy. The virtual network function management policy is deployed to the target node using an NFV orchestrator. When the input vector is input into the feedforward neural network, if the number of data in the first class is less than the number of data in the second class, the learning weight assigned to the first class is set to be greater than the learning weight assigned to the second class.
7. The network security traffic feature compensation and identification method based on graph neural networks according to claim 1, characterized in that, Also includes: Collect traffic change data and detection results after the deployment of virtual network function management policies; The graph neural network model is incrementally trained based on the collected data, and the model parameters are updated.
8. A network security traffic feature compensation and identification system based on graph neural networks, characterized in that, include: The traffic acquisition unit is used to acquire network traffic data of the network under test; The preprocessing unit is used to preprocess the network traffic data to be tested and extract key attributes of the traffic events. The key attributes include at least one of time information, protocol number, destination IP address, and destination port number. Graph construction unit, used to construct a dynamic heterogeneous graph based on the key attributes, wherein the vertices of the dynamic heterogeneous graph are network nodes and the edges are communication behaviors; The feature compensation unit is used to perform feature compensation processing on the dynamic heterogeneous graph, map the nodes in the dynamic heterogeneous graph to a three-dimensional coordinate space, and compensate for the missing feature dimensions. The graph neural network learning unit is used to input the feature-compensated dynamic heterogeneous graph into the graph neural network model to generate the node state information of each node. An anomaly detection unit is used to compare the node status information with a preset sparsity baseline to determine whether the communication behavior of each node deviates from the baseline and output an anomaly score. The strategy generation and deployment unit is used to generate a virtual network function management strategy based on the anomaly score and deploy the virtual network function management strategy to the target node.
9. A network security traffic feature compensation and identification system based on graph neural networks according to claim 8, characterized in that, The feature compensation unit includes: The coordinate mapping module is used to calculate the angular coordinates based on the host portion of the destination IP address, the radius coordinates based on the communication frequency and time attenuation weight, and the height coordinates based on the network portion of the destination IP address. The missing feature detection module is used to detect whether there are missing feature dimensions in the nodes of the dynamic heterogeneous graph. The neighbor aggregation compensation module is used to compensate for missing feature dimensions by aggregating the feature information of neighbor nodes based on time decay weights.
10. A network security traffic feature compensation and identification system based on graph neural networks according to claim 9, characterized in that, The anomaly detection unit includes: The baseline building module is used to calculate the number of times each node accesses each network object, forming an access frequency baseline. The deviation judgment module is used to compare the current communication access frequency with the baseline. If the deviation exceeds a preset threshold, it is judged as a sparsity anomaly. The scoring calculation module is used to calculate anomaly scores based on node status information, deviation from the sparsity baseline, and time entropy.