A network channel security detection method based on capsule network and graph embedding
By combining capsule networks and graph embedding methods, a network communication graph is constructed and a double-layer capsule network is used to evaluate channel security. This solves the accuracy and efficiency problems of channel security detection in existing technologies and achieves efficient security assessment of complex network environments.
Patent Information
- Application Number
- CN202210984172.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-08-17
- Publication Date
- 2025-09-19
- Estimated Expiration
- 2042-08-17
AI Technical Summary
Existing technologies have difficulty in effectively detecting and predicting channel security in network channel allocation, especially in complex and changing network environments. Rule-based methods have low accuracy, while machine learning-based methods have low training efficiency and cannot directly handle large and complex problems.
Combining capsule networks and graph embedding methods, a network communication graph is constructed by collecting terminal information and topological relationships, modeled using graph embedding, and terminal entity representation is generated through a double-layer capsule network to evaluate channel security.
It improves the recognition accuracy of network channel security detection, can effectively detect unsafe situations in complex network environments, and enhances the intelligence and efficiency of channel security prediction.
Smart Images
Figure CN115473693B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network information security technology, and in particular to a network channel security detection method based on capsule network and graph embedding. Background Art
[0002] In recent years, network communications and data transmission methods have undergone numerous technological revolutions, driving the development of the internet and transforming human lifestyles. With the continuous advancement of network technology, the number of connected devices and the amount of data transmitted across networks are growing exponentially. However, this has also brought with it a growing number of security issues. Network data must be transmitted through network communication channels. Ensuring that data is transmitted from source to destination through these channels involves selecting efficient and secure network transmission channels, a critical challenge that currently needs to be addressed.
[0003] In network transmission systems, channel allocation plans are often required to allocate wired channel bandwidth or wireless network resources to base stations, local area networks, or terminal devices. These plans determine the bandwidth and communication channels for base stations, access points, and terminal devices to maximize transmission efficiency. Due to the complexity and constant changes of networks, some terminals or base stations may experience persistent resource shortages. Furthermore, network threats such as Trojans, viruses, and eavesdropping may exist. These threats attempt to subvert existing processes to run unauthorized code, gain user privileges to run malicious programs, and exploit incompatible network protocols through unauthorized means. Consequently, channel allocation may result in the allocation of unsafe channels. Therefore, it is necessary not only to inspect channels before allocation to determine their efficiency and security, but also to employ intelligent methods to predict their future security.
[0004] Currently, there are two main approaches for predicting channel security: rule-based methods and machine learning-based methods. While rule-based methods offer high accuracy, they are ineffective in handling complex and changing situations, often missing unsafe instances not covered by the rules. This makes them difficult to implement for channel security management in large, complex networks. While machine learning-based methods (including deep learning) offer powerful self-learning capabilities and intelligence, they require modeling tailored to the specific scenarios and problems, requiring the design of targeted new methods.
[0005] Capsule networks are a new model proposed in recent years that improves on deep learning models by using local "capsules" to perform complex internal computations on their inputs, then encapsulating the results into a small vector containing rich information. While capsule networks can achieve good results with minimal data, they suffer from slow learning speeds and low training efficiency, making them unsuitable for directly solving large, complex problems.
[0006] Graph (graph / network) data can be used to naturally express the connections between objects and is particularly suitable for data representation in tasks such as network security. Graph embedding is the process of mapping graph data into low-dimensional dense vectors, representing the graph nodes in a low-dimensional vector space while preserving the network's topological structure and node information, allowing the direct use of existing machine learning methods in subsequent graph analysis tasks. In recent years, graph embedding and data-driven methods have achieved success in predictive tasks related to graph structures, including predicting new relationships in social networks, predicting interactions between nodes in networks, predicting and monitoring abnormal events in communication networks, and predicting network traffic. However, the effectiveness of graph embedding methods is not outstanding and needs to be improved by combining other methods based on actual tasks.
[0007] The disclosure of the above background technology content is only used to assist in understanding the inventive concept and technical solution of the present invention. It does not necessarily belong to the prior art of this patent application, nor does it necessarily provide technical guidance. In the absence of clear evidence that the above content has been disclosed before the filing date of this patent application, the above background technology should not be used to evaluate the novelty and creativity of this application. Summary of the Invention
[0008] In order to overcome the shortcomings of the existing technology, the present invention provides a network channel security detection method based on capsule network and graph embedding. The specific technical solution is as follows:
[0009] A network channel security detection method based on capsule network and graph embedding is provided, comprising the following steps:
[0010] Collect the terminal information involved in network transmission and the topological relationship between the terminals. By analyzing the information and security performance of each terminal, we can obtain the node characteristics that can distinguish different terminals and form the node feature set V for each terminal. v (v1,v2,...,v m ), each terminal is linked to form a network communication graph with node features based on its communication transmission relationship; the data transmitted in the current network transmission channel is collected, and various information of the current data is analyzed as the weight feature of each edge in the network communication graph, forming a weight feature set W for each edge e (w1,w2,...,w n ) and derive a network communication graph with nodes and weights;
[0011] Using graph embedding, we model node- and weighted network communication graphs and terminal nodes, and obtain corresponding graph data structures. We define a set of triples directly connected to the terminal, and generate attention weights for each edge based on the original features to determine the receptive domain of the entity corresponding to the terminal, thereby obtaining receptive domain neighbor information.
[0012] Concatenate the head entity representation and relation embedding in the terminal triple (m, j, k) to form a matrix M based on the receptive field neighbor information. mr , for the matrix M mr After filtering, the data is input into the capsule network to generate a vector output as the entity representation of the corresponding terminal. The inner product of the entity representations corresponding to the two terminals is performed to obtain the security score of the data for security judgment.
[0013] Furthermore, the graph data structure includes a point set V{v1,v2,...,v l} and edge set E{e1,e2,e3,...,e n}, where V represents the set of all nodes, and each node v corresponds to a node feature set V v , E represents the set of all edges, each edge e corresponds to a weighted feature set W e .
[0014] Furthermore, the node characteristics include node status and safety judgment status, the node status includes closed, normal operation, abnormal, unable to obtain information and not polled; the safety judgment status includes safe, dangerous, potentially dangerous and unknown; the weight characteristics include analysis of data content and current status of the sending / receiving end.
[0015] Furthermore, the set of triples directly connected to the terminal is defined as: N m ={(m,j,k)|(m,j,k)∈G}, where N m is the triple set of terminals, m is the head entity, j is the tail entity, k is the head-tail entity relationship, and G is the graph data structure.
[0016] Furthermore, N m The attention coefficient of each triple in is recorded as A(m,j,A(m,j,k)=γ(tanh(W e ||V v )), where γ is a constant.
[0017] Furthermore, according to the size of the attention coefficient, the largest N triplets are taken to form the terminal's receptive field Nm, thereby obtaining the terminal's receptive field neighbor information, which is recorded as Among them, W k is the weight of the corresponding edge.
[0018] Furthermore, the head entity m in the triple (m, j, k) is connected with the relation embedding, so that the tail entity j in the triple (m, j, k) is also the head entity r in the other triple, so as to obtain the corresponding receptive field neighbor information of the two triples, and combine them to obtain the matrix M mr .
[0019] Furthermore, M mr Each row is mapped to the feature map Q mr , Q mr =W m W r ·M mr , where W m and W r Represent the weight vectors corresponding to the head entity m and the head entity r respectively, and Q mr Each row of i , put q i Encapsulate into corresponding capsules for capsule network processing.
[0020] Furthermore, the capsule network is a double-layer capsule network, and the output features of the first-layer capsule network are transferred to the second-layer capsule network, wherein the output features corresponding to the terminal corresponding to the head entity m in the first-layer capsule network are recorded as q mi ,q mi =W m ·q i , the corresponding output in the second layer capsule network is denoted as f m , The output feature of the terminal corresponding to the head entity r in the first layer of the capsule network is recorded as q ri ,q ri =W r ·q i , the corresponding output in the second layer capsule network is denoted as f r ,
[0021] Furthermore, the security score between the terminal corresponding to the head entity m and the head entity r is recorded as score(m,r), score(m,r)=σ(f m ·f r ).
[0022] Compared with the existing technology, the present invention has the following advantages: the combination of the graph embedding method and the capsule network fully utilizes the topological characteristics of network transmission, the characteristics of network nodes, and the characteristics of data transmission, thereby improving the recognition accuracy of detecting unsafe situations in data network transmission. BRIEF DESCRIPTION OF THE DRAWINGS
[0023] Figure 1 Schematic diagram of the flow of a network channel security detection method provided by an embodiment of the present invention;
[0024] Figure 2 It is a schematic diagram of the model architecture in the network channel security detection method provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0025] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.
[0026] It should be noted that the terms "first," "second," and the like in the description and claims of the present invention and the accompanying drawings are used to distinguish similar items and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, such that the embodiments of the present invention described herein can be implemented in sequences other than those illustrated or described herein. Furthermore, the terms "including," "having," and any variations thereof are intended to cover non-exclusive inclusions.
[0027] In one embodiment of the present invention, a network channel security detection method based on capsule network and graph embedding is provided. Figure 1 , including the following steps:
[0028] (1) Terminal information collection
[0029] Collect the terminal information involved in network transmission and the topological relationship between the terminals. According to the differences of each terminal, they can be divided into different categories. By analyzing the information and security performance of each terminal, we can obtain the node characteristics that can distinguish different terminals and form the node feature set V of each terminal. v (v1,v2,...,v m ), each terminal forms a network communication graph with node characteristics based on its communication transmission relationship;
[0030] Among them, the node characteristics mainly include node status and security judgment status,
[0031] The node status includes shutdown, normal operation, abnormality, unable to obtain information, and not polled, which can be coded differently. The specific definitions are as follows:
[0032] Off: The device is in the off state, represented by the number 0;
[0033] Normal operation: The device is running and the operating status is normal, indicated by the number 1;
[0034] Abnormal: The device is in operation, but the display status is abnormal, indicated by the number 2;
[0035] Unable to obtain information: In this polling, the device did not return status information within the specified time, represented by the number 3;
[0036] Not polled: In this poll, the device is not required to return status, represented by the number 4.
[0037] Not only is there a terminal node state, but also a judgment action for the current terminal. The action can be to judge the terminal as one of the following safety judgment states: {safe, dangerous, potentially dangerous, unknown}. After taking each action, the next state of the terminal may change to the following states:
[0038] Safety: No impact, indicated by the number 1;
[0039] Danger: Pause operation for further inspection, indicated by the number 0;
[0040] Potential danger: continue to run, but only enable necessary functions, check and confirm, indicated by the number 2;
[0041] Unknown: Continue to operate, but further observation is required, indicated by the number -1.
[0042] It should be noted that the security judgment status can be comprehensively judged based on the node status and the status of the transmitted data.
[0043] (2) Transmission data feature collection
[0044] Collect the data transmitted in the current network transmission channel, analyze various information of the current data as the weight features of each edge in the network communication graph, and form the weight feature set W of each edge e (w1,w2,...,w n ), and derive a network communication graph with nodes and weights; the weight features mainly include analysis of data content and the current status of the sending / receiving end.
[0045] (3) Network modeling and initialization model
[0046] See also Figure 2 , the nodes of the network communication graph with nodes and weights and the nodes of the terminal are modeled by the graph embedding method, and the graph convolutional neural network (GCN) is used to extract features. The graph can be abstractly represented as a graph data structure; wherein the graph data structure contains the point set V{v1,v2,...,v l} and edge set E{e1,e2,e3,...,en}, where V represents the set of all nodes, and each node v corresponds to a node feature set V v , E represents the set of all edges, that is, the set of all channels, and each edge e corresponds to a weighted feature set W e A set of triples directly connected to the terminal is defined, and each edge generates an attention weight based on the original features to determine the receptive field of the entity corresponding to the terminal, and then obtain the receptive field neighbor information.
[0047] Specifically, the graph data structure is a graph convolutional network architecture. The graph embedding layer is built on top of the graph convolutional network architecture, passing information along high-order neighbors. For each edge, an attention weight is generated based on the original features to reveal the importance of this connection, and then the receptive field of the entity is determined. For terminal m, the set of directly connected triples is defined as:
[0048] N m ={(m,j,k)|(m,j,k)∈G}
[0049] where N m is the triple set of terminals, m is the head entity, j is the tail entity, k is the head-tail entity relationship, and G is the graph data structure.
[0050] Calculate N m The attention coefficient of each triple in is recorded as A(m,j,k),
[0051] A(m,j,k)=γ(tanh(W e ||V v ))
[0052] Among them, γ is a constant.
[0053] According to the size of the attention coefficient, the largest N triplets are taken to form the terminal's receptive field Nm, thereby obtaining the terminal's receptive field neighbor information, which is recorded as
[0054]
[0055] Among them, W k is the weight of the corresponding edge.
[0056] (4) Prediction data security
[0057] The data security prediction task can be viewed as a network graph completion task, a key step of which is modeling the relationships between entities. Traditional methods can only capture linear relationships between entities, but this linear transformation is sometimes insufficient for multi-relationship prediction tasks because it fails to capture the deep relational properties of triples across all dimensions. This embodiment, by integrating a two-layer capsule network, obtains entity representations in a specific relational space in a nonlinear manner.
[0058] Connect the head entity representation of the triple (m, j, k) corresponding to the terminal with the relation embedding, so that the tail entity j in the triple (m, j, k) is also the head entity r in the other triple, so as to obtain the corresponding receptive field neighbor information of the two triples, and combine them to obtain a matrix M based on the receptive field neighbor information. mr , M mr ∈R d×2 , and then use p filters of size 1×2 to make M mr Each row is mapped to p feature maps of size d×1, denoted as Q mr ∈R d ×p , Q mr =W m W r ·M mr , W m and W r Represent the weight vectors corresponding to the head entity m and the head entity r respectively, and then map the feature map Q mr Each row of i ,q i =Q mr [i,:], put q i It is encapsulated into the corresponding capsule, processed by the first layer of capsule network to obtain the output feature, and passed to a capsule in the second layer of network. The capsule generates a vector output as the entity representation in the target relation space.
[0059] Specifically, the output feature of the terminal corresponding to the head entity m in the first layer of the capsule network is recorded as q mi ,q mi =W m ·q i , the corresponding output in the second layer capsule network is denoted as f m , The output feature of the terminal corresponding to the head entity r in the first layer of the capsule network is recorded as q ri ,q ri =W r ·q i , the corresponding output in the second layer capsule network is denoted as f r ,
[0060] Finally, the inner product of the entity representations corresponding to the two terminals is performed to obtain the security score of the channel between the two terminals for security evaluation. Generally speaking, the higher the score, the better the security of the channel. Specifically, the security score between the terminals corresponding to the head entity m and the head entity r is recorded as score(m,r), score(m,r)=σ(f m ·f r ), compare the security score with a preset threshold range, and if the preset threshold range conditions are not met, an alarm prompt is issued.
[0061] The network channel security detection method provided by the present invention combines the graph embedding method with the capsule network, making full use of the topological characteristics of network transmission, the characteristics of network nodes, and the characteristics of data transmission. It solves the security problems that arise in detecting network data transmission under the dynamic routing of the capsule network, and is particularly suitable for detecting false data in the network.
[0062] The above description is only a preferred embodiment of the present invention and does not limit the scope of the patent. Any equivalent structure or equivalent process transformation made by using the contents of the description and drawings of the present invention, directly or indirectly applied in other related technical fields, is also included in the scope of patent protection of the present invention.
Claims
1. A network channel security detection method based on capsule network and graph embedding, characterized in that: The following steps are involved: Collect the terminal information involved in network transmission and the topological relationship between the terminals. By analyzing the information and security performance of each terminal, we can obtain the node characteristics that can distinguish different terminals and form the node feature set V for each terminal. v (v1v2,…,v m ), the node characteristics include node status and safety judgment status, the node status includes closed, normal operation, abnormal, unable to obtain information and not polled; the safety judgment status includes safe, dangerous, potentially dangerous and unknown; each terminal is linked to form a network communication graph with node characteristics based on its communication transmission relationship; the data transmitted in the current network transmission channel is collected, and various information of the current data is analyzed as the weight feature of each edge in the network communication graph to form a weight feature set W for each edge e (w1,w2,…,w n ), and derive a network communication graph with nodes and weights; the weight features include analysis of data content and the current state of the sending / receiving end; Use graph embedding to model nodes in network communication graphs with nodes and weights, as well as nodes in terminals, and obtain corresponding graph data structures; Define a set of triples directly connected to the terminal. Each edge generates an attention weight based on the original features to determine the receptive field of the entity corresponding to the terminal, and then obtain the receptive field neighbor information; Concatenate the head entity representation and relation embedding in the terminal triple (m, j, k) to form a matrix M based on the receptive field neighbor information. mr , for the matrix M mr After filtering, the data is input into the capsule network to generate a vector output as the entity representation of the corresponding terminal. The inner product of the entity representations corresponding to the two terminals is performed to obtain the security score of the data for security assessment. Connect the head entity m in the triple (m, j, k) with the relation embedding, so that the tail entity j in the triple (m, j, k) is also the head entity r in another triple, so as to obtain the corresponding receptive field neighbor information of the two triples, and combine them to obtain the matrix M mr ; M mr Each row is mapped to the feature map Q mr , Q mr =W m W r ·M mr , where W m and W r Represent the weight vectors corresponding to the head entity m and the head entity r respectively, and Q mr Each row of i , put q i Encapsulate into the corresponding capsule for capsule network processing: the capsule network is a double-layer capsule network, and the output features of the first layer capsule network are passed to the second layer capsule network, where the output features corresponding to the terminal corresponding to the head entity m in the first layer capsule network are recorded as q mi ,q mi =W m ·q i , the corresponding output in the second layer capsule network is denoted as f m , The output feature of the terminal corresponding to the head entity r in the first layer of the capsule network is recorded as q ri ,q ri =W r ·q i , the corresponding output in the second layer capsule network is denoted as f r , The security score between the terminal corresponding to the head entity m and the head entity r is recorded as score(m,r), score(m,r)=σ(f m ·f r ), compare the security score with a preset threshold range, and if the preset threshold range is not met, an alarm prompt is issued.
2. The network channel security detection method according to claim 1, characterized in that: The graph data structure includes a point set V{v1,v2,...,v l } and edge set E{e1,e2,e3,...,e n }, where V represents the set of all nodes, and each node v corresponds to a node feature set V v , E represents the set of all edges, each edge e corresponds to a weighted feature set W e .
3. The network channel security detection method according to claim 2, characterized in that: Define the set of triples directly connected to the terminal as: N m ={(m,j,k)|(m,j,k)∈G}, where N m is the triple set of terminals, m is the head entity, j is the tail entity, k is the head-tail entity relationship, and G is the graph data structure.
4. The network channel security detection method according to claim 3, characterized in that: N m The attention coefficient of each triple in is recorded as A(m,j,k), A(m,j,k)=γ(tanh(W e ||V v )), where γ is a constant.
5. The network channel security detection method according to claim 4, characterized in that: According to the size of the attention coefficient, the largest N triplets are taken to form the terminal's receptive field Nm, thereby obtaining the terminal's receptive field neighbor information, recorded as Among them, W k is the weight of the corresponding edge.