Flow detection method, device, electronic device and computer-readable storage medium

Abstract

The present application belongs to the field of network security technology, and discloses a method, device, electronic device and computer-readable storage medium for flow detection. The method includes: constructing a topology map based on the network address information and port information of the transmission data to be detected, and the network nodes in the topology map are constructed based on the network address information and port information; generating edge feature vectors corresponding to each edge in the topology map based on the transmission association information of each transmission data; the edges in the topology map are generated based on the connections between each network node; obtaining the flow detection results corresponding to each edge in the topology map based on the topology map, each edge feature vector, and a pre-trained flow detection model, and the flow detection model is constructed based on a graph neural network and residual connections. In this way, by using the topology map, flow detection can be performed based on each network node and its dependency relationship, thereby improving the accuracy of flow detection.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, electronic device, and computer-readable storage medium for flow detection. Background Art

[0002] With the development of the Internet of Things (IoT) and communication technologies, the number of devices in networks is increasing. For example, IoT networks include multiple connected devices (e.g., edge devices such as cameras, temperature sensors, smart TVs, and wireless printers). As the number of devices in a network increases, the frequency and sophistication of cyberattacks are also increasing significantly.

[0003] Under the existing technology, a signature-based passive intrusion detection system is usually used for detection. However, this method can only effectively detect known attacks. If a new attack appears, the detection effect is poor. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to provide a method, device, electronic device and computer-readable storage medium for flow detection, so as to improve the accuracy of flow detection results when performing flow detection.

[0005] In one aspect, a method for flow detection is provided, comprising:

[0006] Based on the network address information and port information of the transmission data to be detected, a topology map is constructed, where the network nodes in the topology map are constructed according to the network address information and port information;

[0007] Generate edge feature vectors corresponding to each edge in the topology graph based on the transmission association information of each transmission data; the edges in the topology graph are generated based on the connections between each network node;

[0008] According to the topology map, the feature vectors of each edge, and the pre-trained traffic detection model, the traffic detection results corresponding to each edge in the topology map are obtained. The traffic detection model is built based on graph neural networks and residual connections.

[0009] In the above implementation process, a topology graph and its corresponding edge feature vectors are constructed based on the transmission data and transmission-related data, so that traffic detection can be performed according to each network node and its dependency relationship, thereby improving the accuracy of traffic detection.

[0010] In one embodiment, the network address information includes a source Internet Protocol (IP) address and a destination IP address, the port information includes a source port and a destination port, and the network nodes include a source node and a destination node. Constructing a topology map based on the network address information and port information of the transmission data to be detected includes:

[0011] According to the source IP address and source port in each transmission data, the source node corresponding to each transmission data is constructed;

[0012] According to the destination IP address and destination port in each transmission data, the destination node corresponding to each transmission data is constructed;

[0013] Connect the source node and destination node corresponding to each transmission data to obtain a topology graph.

[0014] In the above implementation process, a network node can be constructed for each group of IP addresses and ports respectively, so that nodes can be divided according to IP addresses and ports.

[0015] In one embodiment, the traffic detection model is trained using the following steps:

[0016] Based on the training data, construct a topology sample and an edge feature vector corresponding to each edge in the topology sample;

[0017] Input the topology graph samples and the feature vectors of each edge into the graph neural network model to obtain the traffic detection results corresponding to each edge in the topology graph;

[0018] According to the training data, obtain the sample labels of each edge;

[0019] Determine the model loss based on the traffic detection results and sample labels corresponding to each edge;

[0020] According to the model loss, the parameters of the graph neural network model are adjusted until a traffic detection model that meets the training conditions is obtained.

[0021] In the above implementation process, training is performed based on the graph neural network model to obtain a traffic detection model.

[0022] In one embodiment, a topology sample and each edge feature vector are input into a graph neural network model to obtain a flow detection result corresponding to each edge in the topology, including:

[0023] Based on the IP address and port corresponding to each network node in the topology sample, a node feature vector corresponding to each network node is generated;

[0024] Based on the feature vectors of each node and each edge, a convolution operation is performed to obtain the feature vectors of each edge after the convolution operation;

[0025] According to the feature vector of each edge after the convolution operation, the malicious traffic probability of each edge is obtained;

[0026] According to the malicious traffic probability of each edge, the traffic detection results of each edge are obtained.

[0027] In the above implementation process, convolution operation is performed on the node feature vector and the edge feature vector to obtain the detection result.

[0028] In one embodiment, a convolution operation is performed based on each node feature vector and each edge feature vector to obtain each edge feature vector after the convolution operation, including:

[0029] The following steps are executed repeatedly until the convolution operation conditions are met:

[0030] For the target node in each node, based on the edge feature vectors corresponding to the target node and the adjacent nodes, generate the target node's aggregation vector, and the target node is any node in each node;

[0031] Obtain a new node feature vector of the target node according to the node feature vector and the aggregation vector of the target node;

[0032] For the first node and the second node in each node, new edge feature vectors corresponding to the first node and the second node are obtained based on the new node feature vector of the first node, the new node feature vector of the second node, and the edge feature vectors corresponding to the first node and the second node; the first node and the second node are any two adjacent network nodes in each node.

[0033] In the above implementation process, the convolution operation is performed multiple times in a cycle.

[0034] In one embodiment, generating an aggregation vector of a target node based on edge feature vectors corresponding to the target node and adjacent nodes includes:

[0035] Filter out a set number of adjacent nodes from the target node's adjacent nodes;

[0036] The edge feature vectors corresponding to the target node and the filtered adjacent nodes are averaged to obtain the aggregate vector.

[0037] In the above implementation process, the aggregate vector is obtained through averaging operation.

[0038] In one embodiment, obtaining a new node feature vector of the target node according to the node feature vector and the aggregation vector of the target node includes:

[0039] Concatenate the node feature vector and the aggregation vector of the target node to obtain a first concatenated vector;

[0040] Based on the first concatenated vector, a new node feature vector is obtained.

[0041] In the above implementation process, the node feature vector is updated through vector concatenation.

[0042] In one embodiment, obtaining new edge feature vectors corresponding to the first node and the second node based on the new node feature vector of the first node, the new node feature vector of the second node, and the edge feature vectors corresponding to the first node and the second node includes:

[0043] Concatenate the new node feature vector of the first node, the new node feature vector of the second node, and the edge feature vectors corresponding to the first node and the second node to obtain a second concatenated vector;

[0044] According to the second concatenated vector, a new edge feature vector is obtained.

[0045] In the above implementation process, the edge feature vector is updated through vector concatenation.

[0046] In one aspect, a flow detection device is provided, comprising:

[0047] A construction unit, configured to construct a topology map based on the network address information and port information of the transmission data to be detected, wherein the network nodes in the topology map are constructed according to the network address information and port information;

[0048] A generating unit, configured to generate an edge feature vector corresponding to each edge in the topology graph according to transmission association information of each transmission data; the edges in the topology graph are generated based on connections between each network node;

[0049] The acquisition unit is used to obtain the traffic detection results corresponding to each edge in the topology diagram based on the topology diagram, the feature vectors of each edge, and a pre-trained traffic detection model. The traffic detection model is constructed based on a graph neural network and residual connections.

[0050] In one embodiment, the network address information includes a source Internet Protocol (IP) address and a destination IP address, the port information includes a source port and a destination port, the network node includes a source node and a destination node, and the construction unit is configured to:

[0051] According to the source IP address and source port in each transmission data, the source node corresponding to each transmission data is constructed;

[0052] According to the destination IP address and destination port in each transmission data, the destination node corresponding to each transmission data is constructed;

[0053] Connect the source node and destination node corresponding to each transmission data to obtain a topology graph.

[0054] In one embodiment, the obtaining unit is further configured to:

[0055] The following steps are used to train the traffic detection model:

[0056] Based on the training data, construct a topology sample and an edge feature vector corresponding to each edge in the topology sample;

[0057] Input the topology graph samples and the feature vectors of each edge into the graph neural network model to obtain the traffic detection results corresponding to each edge in the topology graph;

[0058] According to the training data, obtain the sample labels of each edge;

[0059] Determine the model loss based on the traffic detection results and sample labels corresponding to each edge;

[0060] According to the model loss, the parameters of the graph neural network model are adjusted until a traffic detection model that meets the training conditions is obtained.

[0061] In one embodiment, the obtaining unit is further configured to:

[0062] Based on the IP address and port corresponding to each network node in the topology sample, a node feature vector corresponding to each network node is generated;

[0063] Based on the feature vectors of each node and each edge, a convolution operation is performed to obtain the feature vectors of each edge after the convolution operation;

[0064] According to the feature vector of each edge after the convolution operation, the malicious traffic probability of each edge is obtained;

[0065] According to the malicious traffic probability of each edge, the traffic detection results of each edge are obtained.

[0066] In one embodiment, the obtaining unit is further configured to:

[0067] The following steps are executed repeatedly until the convolution operation conditions are met:

[0068] For the target node in each node, based on the edge feature vectors corresponding to the target node and the adjacent nodes, generate the target node's aggregation vector, and the target node is any node in each node;

[0069] Obtain a new node feature vector of the target node according to the node feature vector and the aggregation vector of the target node;

[0070] For the first node and the second node in each node, new edge feature vectors corresponding to the first node and the second node are obtained based on the new node feature vector of the first node, the new node feature vector of the second node, and the edge feature vectors corresponding to the first node and the second node; the first node and the second node are any two adjacent network nodes in each node.

[0071] In one embodiment, the obtaining unit is further configured to:

[0072] Filter out a set number of adjacent nodes from the target node's adjacent nodes;

[0073] The edge feature vectors corresponding to the target node and the filtered adjacent nodes are averaged to obtain the aggregate vector.

[0074] In one embodiment, the obtaining unit is further configured to:

[0075] Concatenate the node feature vector and the aggregation vector of the target node to obtain a first concatenated vector;

[0076] Based on the first concatenated vector, a new node feature vector is obtained.

[0077] In one embodiment, the obtaining unit is further configured to:

[0078] Concatenate the new node feature vector of the first node, the new node feature vector of the second node, and the edge feature vectors corresponding to the first node and the second node to obtain a second concatenated vector;

[0079] According to the second concatenated vector, a new edge feature vector is obtained.

[0080] On the one hand, an electronic device is provided, comprising a processor and a memory, wherein the memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, the steps of the method provided in any of the various optional implementations of the above-mentioned flow detection are executed.

[0081] On the one hand, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method provided in any of the various optional implementations of the above-mentioned traffic detection are executed.

[0082] On the one hand, a computer program product is provided. When the computer program product is run on a computer, it enables the computer to perform the steps of the method provided in any of the various optional implementations of any of the above-mentioned traffic detection.

[0083] Other features and advantages of the present application will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present application. The purposes and other advantages of the present application can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0084] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0085] Figure 1 A flow chart of a method for training a flow detection model provided in an embodiment of the present application;

[0086] Figure 2 An example diagram of a triple provided in an embodiment of the present application;

[0087] Figure 3 A flow chart of a method for flow detection provided in an embodiment of the present application;

[0088] Figure 4 This is an example diagram of a topology diagram provided in an embodiment of the present application;

[0089] Figure 5 An example graph of nodes and edges provided in an embodiment of the present application;

[0090] Figure 6 A schematic diagram of a flow detection framework provided in an embodiment of the present application;

[0091] Figure 7 A structural block diagram of a flow detection device provided in an embodiment of the present application;

[0092] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0093] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work fall within the scope of protection of the present application.

[0094] First, some of the terms involved in the embodiments of the present application are explained to facilitate understanding by those skilled in the art.

[0095] Terminal device: can be a mobile terminal, fixed terminal or portable terminal, such as a mobile phone, station, unit, device, multimedia computer, multimedia tablet, Internet node, communicator, desktop computer, laptop computer, notebook computer, netbook computer, tablet computer, personal communication system device, personal navigation device, personal digital assistant, audio / video player, digital camera / camcorder, positioning device, television receiver, radio broadcast receiver, e-book device, gaming device or any combination thereof, including accessories and peripherals of these devices or any combination thereof. It is also foreseeable that the terminal device can support any type of user interface (such as wearable device), etc.

[0096] Server: It can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, and big data and artificial intelligence platforms.

[0097] In order to improve the accuracy of detection results when performing flow detection, embodiments of the present application provide a flow detection method, apparatus, electronic device, and computer-readable storage medium.

[0098] In the embodiment of the present application, it can be applied to electronic devices, and the electronic devices can be servers or terminal devices.

[0099] In the embodiment of the present application, before performing flow detection, model training is first performed to obtain a flow detection model. Figure 1 FIG. 1 is a flow chart of a method for training a flow detection model provided by an embodiment of the present application. The specific implementation process of the method is as follows:

[0100] Step 100: Based on the training data, construct a topology sample and the edge feature vector corresponding to each edge in the topology sample. Step 101: Input the topology sample and each edge feature vector into the graph neural network model to obtain the traffic detection results corresponding to each edge in the topology. Step 102: Based on the training data, obtain the sample label of each edge. Step 103: Determine the model loss based on the traffic detection results and sample labels corresponding to each edge. Step 104: Based on the model loss, adjust the parameters of the graph neural network model until a traffic detection model that meets the training conditions is obtained.

[0101] In one embodiment, when executing step 100, the following steps may be performed:

[0102] S1000: Parse the transmission data samples in the training data to obtain network address information and port information of the transmission data samples.

[0103] The training data includes the transmission data samples and sample labels. The network address information includes the source Internet Protocol (IP) address and the destination IP address. The port information includes the source port and the destination port.

[0104] Furthermore, transmission association information of the transmitted data sample may also be obtained.

[0105] The transmission-related information may include but is not limited to at least one of the following information:

[0106] Transport layer protocol, application layer protocol, timestamp, number of uplink bytes, number of downlink bytes, uplink Time To Live (TTL), downlink TTL, uplink packet loss rate, downlink packet loss rate, uplink bytes per second, downlink bytes per second, and service type.

[0107] The service type may include but is not limited to at least one of the following types:

[0108] Hyper Text Transport Protocol (HTTP), Domain Name System (DNS), File Transfer Protocol (FTP), Secure Shell (SSH).

[0109] In one embodiment, a triplet of the transmitted data sample is generated based on the network address information, port information, and transmission association information of the transmitted data sample. The triplet includes first-category features (i.e., source IP address and source port), second-category features (destination IP address and destination port), and transmission association information.

[0110] See Figure 2 The following is an example diagram of a triple. Figure 2 , which includes multiple triplets of transmitted data samples.

[0111] The transmitted data samples include positive samples and negative samples.

[0112] In one embodiment, the transmission data sample is obtained by the following steps:

[0113] S1000-1: Collect traffic data of multiple sample devices (eg, hosts) as positive samples.

[0114] As an example, the traffic data of all sample devices within a set time period (eg, a fixed-size time window t=300s) is collected by a traffic collection device.

[0115] S1000-2: Control multiple sample devices in each sample device to perform simulated network attack operations.

[0116] As an example, multiple sample devices are randomly selected from the sample devices, and after the selected sample devices start normal services, they are controlled to send attack data to each other and / or to sample devices that are not screened out.

[0117] S1000-3: Collect attack data sent by the screened sample devices as negative samples.

[0118] As an example, the attack data sent by each filtered sample device within a set time period (eg, a fixed-size time window t=300s) is collected by a traffic collection device.

[0119] S1001: Constructing source nodes corresponding to the respective transmission data samples according to the source IP addresses and source ports in the respective transmission data samples.

[0120] S1002: Construct a destination node corresponding to each transmission data according to the destination IP address and destination port in each transmission data sample.

[0121] In other words, the binary combination of IP address and port is considered a network node. The binary pair (source IP address, source port) corresponds one-to-one to the source node, and the binary pair (destination IP address, destination port) corresponds one-to-one to the destination node.

[0122] S1003: Connect the source node and destination node corresponding to each transmission data to obtain a topology graph.

[0123] Specifically, the network nodes are connected according to the transmission data, so that an undirected edge exists between adjacent network nodes.

[0124] The topology graph sample is constructed from multiple network nodes. Network nodes include source nodes and destination nodes. Edges in the topology graph are obtained by connecting source and destination nodes. Each network node corresponds to a 2-tuple, which contains an IP address and port, namely (IP address and port).

[0125] Furthermore, the triplets of the collected transmission data samples can be stored in one or more feature files according to a set time length (e.g., according to a time window), and a topology map sample (also called a time snapshot traffic map) can be generated based on the triplets in the feature file, and the topology map sample can be stored in the device disk in a set format.

[0126] In actual applications, the set duration (such as 300s) and the set format can be set according to the actual application scenario and are not limited here.

[0127] In this way, the feature files in all time windows can be read cyclically, and each transmission data sample can be analyzed to obtain the triples corresponding to each transmission data sample. Based on the network address information and port information in the triples, each network node can be constructed to obtain a topology sample. Based on the transmission association data in the triples, the edge feature vectors connecting adjacent network nodes can be generated.

[0128] The traffic detection model is trained on a graph neural network model. Both the traffic detection model and the graph neural network model are built on ResEdge-GraphSAGE and are used to classify each flow generated by communications between network nodes. ResEdge-GraphSAGE is a graph neural network. ResEdge-GraphSAGE improves the GraphSAGE model to support edge classification. Unlike the GraphSAGE model, the ResEdge-GraphSAGE model adds edge residual connections and edge feature aggregation, achieving edge embedding encoding.

[0129] In one embodiment, in step 101, the topology graph sample and each edge feature vector are input into the graph neural network model to obtain the flow detection result corresponding to each edge in the topology graph. The implementation process may include:

[0130] S1011: Based on the IP address and port corresponding to each network node in the topology map sample, generate a node feature vector corresponding to each network node.

[0131] As an example, based on the (IP address, port) of the network node, vector initialization is performed to obtain the node feature vector, for example, the node feature vector is [1, 1, ..., 1].

[0132] S1012: Perform a convolution operation based on the feature vectors of each node and each edge to obtain the feature vectors of each edge after the convolution operation.

[0133] S1013: Obtain malicious traffic probability on each edge based on the feature vector of each edge after the convolution operation.

[0134] S1014: Obtain traffic detection results for each edge based on the malicious traffic probability of each edge.

[0135] A topology sample can be represented as G(V, E), where V denotes the network nodes in the topology sample and E denotes the edges in the topology sample. Multiple graph convolutional layers can then be established based on G(V, E). Each graph convolutional layer performs similar convolution operations. Each graph convolutional layer updates the edge feature vectors in the topology sample, representing the global encoding features of the traffic between each network node in the topology sample.

[0136] In one implementation, the implementation process of S1012 may include:

[0137] The following steps are executed repeatedly until the convolution operation conditions are met:

[0138] S1012-1: For a target node among the nodes, generate an aggregation vector of the target node based on edge feature vectors corresponding to the target node and adjacent nodes.

[0139] The target node is any node among the nodes;

[0140] S1012-2: Obtain a new node feature vector of the target node according to the node feature vector and the aggregation vector of the target node.

[0141] S1012-3: For the first node and the second node in each node, based on the new node feature vector of the first node, the new node feature vector of the second node, and the edge feature vectors corresponding to the first node and the second node, obtain the new edge feature vectors corresponding to the first node and the second node.

[0142] The first node and the second node are any two adjacent network nodes among the nodes.

[0143] In one implementation, the implementation process of S1012-1 may include:

[0144] A set number of adjacent nodes are selected from the adjacent nodes of the target node; the edge feature vectors corresponding to the target node and the selected adjacent nodes are averaged to obtain an aggregate vector.

[0145] The adjacent nodes of the target node are network nodes directly connected to the target node.

[0146] Optionally, the aggregation vector can be expressed as follows:

[0147]

[0148] Among them, AGG is the average aggregation function, i represents the serial number of the target node, u represents the serial number of the adjacent node of the target node, k represents the serial number of the graph convolution layer, s represents the total number of adjacent nodes screened out, and N represents the node set. It represents a node set consisting of s adjacent nodes selected from the adjacent nodes of the target node i. Represents the aggregate vector of target node i after the convolution operation of the kth graph convolution layer. is the edge feature vector generated by the edge connecting the target node i and the adjacent node u after the convolution operation of the k-1th graph convolution layer. When k = 1, h uiis the initial edge feature vector generated based on the transmission association data between the target node i and the adjacent node u. I, u, k, and s are all natural numbers.

[0149] In one implementation, the implementation process of S1012-2 may include:

[0150] The node feature vector of the target node and the aggregation vector are concatenated to obtain a first concatenated vector; and a new node feature vector is obtained based on the first concatenated vector.

[0151] Optionally, when obtaining the node feature vector, the following formula can be used:

[0152]

[0153] Among them, σ is a nonlinear activation function, such as ReLU function, k represents the sequence number of the graph convolution layer, i represents the sequence number of the target node, and n is the total number of graph convolution layers. is the learnable parameter matrix of the k-th graph convolutional layer, represents the aggregate vector generated by the target node i after the convolution operation of the k-graph convolutional layer, and || represents vector concatenation. represents the node feature vector generated by the target node i after the convolution operation of the k-1th graph convolution layer, Represents the node feature vector generated by the target node i after the convolution operation of the kth graph convolution layer. For easy distinction and understanding, It can also be called a node encoding vector. The initial vector (h i ) is a node feature vector generated based on the IP address and port of the target node.

[0154] In this embodiment, to preserve the original information of edges, residual connections are added when generating feature vectors for graph nodes and edges. The feature vectors of nodes and edges are updated only based on the residuals calculated from adjacent nodes, thus preserving the original characteristics of the nodes. Even if the categories of the node's adjacent nodes are extremely unbalanced, this will not affect the original information of the node, thus eliminating the impact of unbalanced data.

[0155] In one embodiment, the implementation process of S1012-3 may include: concatenating the new node feature vector of the first node, the new node feature vector of the second node, and the edge feature vectors corresponding to the first node and the second node to obtain a second concatenated vector; and obtaining a new edge feature vector based on the second concatenated vector. Optionally, the following formula may be used to obtain the new edge feature vector:

[0156]

[0157] Among them, σ is a nonlinear activation function, k represents the sequence number of the graph convolution layer, i represents the sequence number of the target node, and u represents the sequence number of the adjacent nodes of the target node. is the learnable parameter matrix of the k-th graph convolutional layer, is the node feature vector generated after the convolution operation of the k-th graph convolution layer of the adjacent node u, The node feature vector generated after the convolution operation of the k-th graph convolution layer of the target node i, || represents vector concatenation. Represents the edge feature vector between the target node i and the adjacent node u after the convolution operation of the k-1th graph convolution layer. Represents the edge feature vector generated after the convolution operation of the kth graph convolution layer between the target node i and the adjacent node u. For easy distinction and understanding, It can also be called edge encoding vector, The initial vector (h ui ) is the edge feature vector generated based on the transmission association data between the target node i and the adjacent node u.

[0158] The process of obtaining the malicious traffic probability of each edge according to the feature vector of each edge after the convolution operation in S1013 may include:

[0159] Through a fully connected layer, the new edge feature vector obtained by the convolution operation is classified into two categories to obtain the probability that each edge (i.e., the transmission data sample between network nodes) is malicious traffic (i.e., the malicious traffic probability).

[0160] In this way, the new edge feature vectors between each network node in the topology graph sample can be obtained through graph convolution operations with residual connections, and the malicious traffic probability of each edge can be obtained based on the new edge feature vectors.

[0161] S1014: Obtain traffic detection results for each edge based on the malicious traffic probability of each edge.

[0162] In one embodiment, if the malicious traffic probability of an edge is higher than a set probability, the transmission data sample corresponding to the edge is determined to be malicious traffic (ie, traffic detection result); otherwise, the transmission data sample corresponding to the edge is normal traffic.

[0163] In one embodiment, the process of obtaining the sample labels of each edge based on the training data in step 102 may include:

[0164] Get the sample labels of each edge also included in the training data.

[0165] Before executing step 102 , the transmission data samples corresponding to each edge may be marked to obtain a sample label of each edge, for example, malicious traffic is marked as 1 and normal traffic is marked as 0.

[0166] In one embodiment, in step 104, the parameters of the graph neural network model are adjusted according to the model loss until a traffic detection model that meets the training conditions is obtained. In the implementation process, the training conditions can be set according to the actual application scenario, such as the model loss is lower than the set loss, etc., which is not limited here.

[0167] Furthermore, the trained traffic detection model can be stored in the device disk.

[0168] In this way, the topology map samples and their corresponding edge feature vectors and sample labels can be input into the graph neural network model, and after hyperparameter adjustment and multi-batch training optimization, the optimal traffic detection model can be obtained and stored.

[0169] See Figure 3 The flow chart of a method for flow detection provided by an embodiment of the present application is shown in FIG. Figure 3 right Figure 1 The method of performing flow detection based on the flow detection model in the flow detection method is described. The specific implementation process of this method is as follows:

[0170] Step 300: Construct a topology map based on the network address information and port information of the transmission data to be detected.

[0171] The network nodes in the topology diagram are constructed based on network address information and port information.

[0172] In one embodiment, the implementation process of step 300 may include:

[0173] S3001: Constructing source nodes corresponding to each transmission data according to the source IP address and source port in each transmission data.

[0174] S3002: Construct a destination node corresponding to each transmission data according to the destination IP address and destination port in each transmission data.

[0175] S3003: Connect the source node and destination node corresponding to each transmission data to obtain a topology map.

[0176] Specifically, the topology map may be created based on the same principle as that of creating the topology map sample in step 100 , which will not be described in detail here.

[0177] Step 301: Generate an edge feature vector corresponding to each edge in the topology graph according to the transmission association information of each transmission data.

[0178] The edges in the topology graph are generated based on the connections between network nodes.

[0179] See Figure 4 The figure shows an example of a topology diagram. Figure 4In the topology graph, multiple network nodes and edges generated by connecting different network nodes are included. The transmission associated data of each network node, i.e., V1, V2, ... V6, and each edge can be represented as E1, E2 ... E5.

[0180] See Figure 5 , which is an example graph of nodes and edges. Figure 5 It includes the IP addresses and ports of multiple network nodes, as well as the transmission association data E0, E1, E2...E5 of multiple edges.

[0181] Step 302: Obtain the flow detection results corresponding to each edge in the topology graph according to the topology graph, the feature vectors of each edge, and the pre-trained flow detection model.

[0182] Among them, the traffic detection model is built based on graph neural network and residual connection.

[0183] In one embodiment, for each traffic to be predicted (i.e., transmission data to be detected), each triplet of traffic to be predicted is extracted, and based on each triplet of traffic to be predicted, a topology map and its corresponding edge feature vector are constructed, and the topology map and its corresponding edge feature vector are input into a traffic detection model to obtain the malicious traffic probability of each edge, and the traffic to be predicted corresponding to the edge with a malicious traffic probability higher than the probability p (i.e., a set probability, such as p can be 0.5) is determined to be malicious traffic; otherwise, it is determined to be normal traffic.

[0184] See Figure 6 , which is a schematic diagram of a flow detection framework. Figure 6 It includes traffic collection module, topology map construction module, model training module, disk storage module and traffic detection module.

[0185] The traffic collection module is used to collect transmission data or transmission data samples. The topology map construction module is used to construct a topology map or a topology map sample. The model training module is used to perform model training to obtain a traffic detection model. The disk storage module is used to store the traffic detection model on the device disk. The traffic detection module uses the traffic detection model to perform traffic detection based on the topology map and its corresponding edge feature vectors, and obtains traffic detection results for each edge.

[0186] Specifically, Figure 6 For the specific implementation steps of each module, refer to the above steps 100 to 104 and steps 300 to 302, which will not be repeated here.

[0187] In an embodiment of the present application, the traffic of all network nodes is connected into a topological graph, and the source IP and source port, destination IP and destination port of the traffic are respectively used as network nodes of the topological graph, and the traffic generated between two network nodes is used as the edge of the graph to characterize the dependency relationship between the network nodes in the network. Furthermore, the GraphSAGE network for node classification is improved to obtain a ResEdge-GraphSAGE network that can be used for edge classification, and the ResEdge-GraphSAGE network is used for automated traffic global feature representation learning and graph topology pattern learning, which solves the problem that traditional traffic detection methods are difficult to capture global traffic features, graph topology relationships in non-Euclidean space, and mutual influences between nodes; at the same time, the original features of network nodes and edges in the topological graph are retained through residual connections, and the feature vectors of nodes and edges can be updated only based on the residuals calculated from adjacent nodes, effectively solving the model tilt problem caused by the imbalance of positive and negative samples.

[0188] Based on the same inventive concept, a flow detection device is also provided in the embodiment of the present application. Since the principle of solving the problem by the above-mentioned device and equipment is similar to that of a flow detection method, the implementation of the above-mentioned device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0189] like Figure 7 As shown, it is a structural diagram of a flow detection device provided in an embodiment of the present application, including:

[0190] A construction unit 701 is configured to construct a topology map based on the network address information and port information of the transmission data to be detected, wherein the network nodes in the topology map are constructed based on the network address information and port information;

[0191] A generating unit 702 is configured to generate an edge feature vector corresponding to each edge in the topology graph according to the transmission association information of each transmission data; the edges in the topology graph are generated based on the connections between each network node;

[0192] The acquisition unit 703 is used to obtain the traffic detection results corresponding to each edge in the topology diagram according to the topology diagram, the feature vectors of each edge, and a pre-trained traffic detection model. The traffic detection model is constructed based on a graph neural network and residual connections.

[0193] In one embodiment, the network address information includes a source Internet Protocol (IP) address and a destination IP address, the port information includes a source port and a destination port, and the network node includes a source node and a destination node. The construction unit 701 is configured to:

[0194] According to the source IP address and source port in each transmission data, the source node corresponding to each transmission data is constructed;

[0195] According to the destination IP address and destination port in each transmission data, the destination node corresponding to each transmission data is constructed;

[0196] Connect the source node and destination node corresponding to each transmission data to obtain a topology graph.

[0197] In one implementation, the obtaining unit 703 is further configured to:

[0198] The following steps are used to train the traffic detection model:

[0199] Based on the training data, construct a topology sample and an edge feature vector corresponding to each edge in the topology sample;

[0200] Input the topology graph samples and the feature vectors of each edge into the graph neural network model to obtain the traffic detection results corresponding to each edge in the topology graph;

[0201] According to the training data, obtain the sample labels of each edge;

[0202] Determine the model loss based on the traffic detection results and sample labels corresponding to each edge;

[0203] According to the model loss, the parameters of the graph neural network model are adjusted until a traffic detection model that meets the training conditions is obtained.

[0204] In one implementation, the obtaining unit 703 is further configured to:

[0205] Based on the IP address and port corresponding to each network node in the topology sample, a node feature vector corresponding to each network node is generated;

[0206] Based on the feature vectors of each node and each edge, a convolution operation is performed to obtain the feature vectors of each edge after the convolution operation;

[0207] According to the feature vector of each edge after the convolution operation, the malicious traffic probability of each edge is obtained;

[0208] According to the malicious traffic probability of each edge, the traffic detection results of each edge are obtained.

[0209] In one implementation, the obtaining unit 703 is further configured to:

[0210] The following steps are executed repeatedly until the convolution operation conditions are met:

[0211] For the target node in each node, based on the edge feature vectors corresponding to the target node and the adjacent nodes, generate the target node's aggregation vector, and the target node is any node in each node;

[0212] Obtain a new node feature vector of the target node according to the node feature vector and the aggregation vector of the target node;

[0213] For the first node and the second node in each node, new edge feature vectors corresponding to the first node and the second node are obtained based on the new node feature vector of the first node, the new node feature vector of the second node, and the edge feature vectors corresponding to the first node and the second node; the first node and the second node are any two adjacent network nodes in each node.

[0214] In one implementation, the obtaining unit 703 is further configured to:

[0215] Filter out a set number of adjacent nodes from the target node's adjacent nodes;

[0216] The edge feature vectors corresponding to the target node and the filtered adjacent nodes are averaged to obtain the aggregate vector.

[0217] In one implementation, the obtaining unit 703 is further configured to:

[0218] Concatenate the node feature vector and the aggregation vector of the target node to obtain a first concatenated vector;

[0219] Based on the first concatenated vector, a new node feature vector is obtained.

[0220] In one implementation, the obtaining unit 703 is further configured to:

[0221] Concatenate the new node feature vector of the first node, the new node feature vector of the second node, and the edge feature vectors corresponding to the first node and the second node to obtain a second concatenated vector;

[0222] According to the second concatenated vector, a new edge feature vector is obtained.

[0223] In the method, device, electronic device and computer-readable storage medium for flow detection provided by the embodiments of the present application, a topology map is constructed based on the network address information and port information of the transmission data to be detected, and the network nodes in the topology map are constructed based on the network address information and port information; the edge feature vectors corresponding to each edge in the topology map are generated based on the transmission association information of each transmission data; the edges in the topology map are generated based on the connections between each network node; the flow detection results corresponding to each edge in the topology map are obtained based on the topology map, each edge feature vector, and a pre-trained flow detection model, and the flow detection model is constructed based on a graph neural network and residual connections. In this way, based on the transmission data and the transmission association data, a topology map and its corresponding edge feature vectors are constructed, so that flow detection can be performed according to each network node and its dependency relationship, thereby improving the accuracy of flow detection.

[0224] Figure 8 FIG1 shows a schematic diagram of the structure of an electronic device 8000. Figure 8As shown, the electronic device 8000 includes: a processor 8010 and a memory 8020, and optionally, may also include a power supply 8030, a display unit 8040, and an input unit 8050.

[0225] The processor 8010 is the control center of the electronic device 8000. It uses various interfaces and lines to connect various components, and performs various functions of the electronic device 8000 by running or executing software programs and / or data stored in the memory 8020, thereby monitoring the electronic device 8000 as a whole.

[0226] In the embodiment of the present application, the processor 8010 executes the various steps in the above embodiment when calling the computer program stored in the memory 8020.

[0227] Optionally, the processor 8010 may include one or more processing units. Preferably, the processor 8010 may integrate an application processor and a modem processor, wherein the application processor primarily processes the operating system, user interface, and applications, and the modem processor primarily processes wireless communications. It is understood that the modem processor may not be integrated into the processor 8010. In some embodiments, the processor and memory may be implemented on a single chip. In some embodiments, they may also be implemented on separate chips.

[0228] The memory 8020 may mainly include a program storage area and a data storage area. The program storage area may store an operating system, various applications, etc., and the data storage area may store data created based on the use of the electronic device 8000. In addition, the memory 8020 may include a high-speed random access memory and a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device.

[0229] The electronic device 8000 also includes a power supply 8030 (such as a battery) for supplying power to various components. The power supply can be logically connected to the processor 8010 through a power management system, thereby managing functions such as charging, discharging, and power consumption through the power management system.

[0230] The display unit 8040 can be used to display information input by the user or information provided to the user, as well as various menus of the electronic device 8000. In the embodiment of the present invention, it is mainly used to display the display interface of each application in the electronic device 8000 and objects such as text and pictures displayed on the display interface. The display unit 8040 may include a display panel 8041. The display panel 8041 can be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), etc.

[0231] The input unit 8050 can be used to receive information such as numbers or characters input by the user. The input unit 8050 may include a touch panel 8051 and other input devices 8052. The touch panel 8051, also known as a touch screen, can receive user touch operations on or near it (for example, operations performed by the user using a finger, a stylus, or any other suitable object or accessory on or near the touch panel 8051).

[0232] Specifically, the touch panel 8051 can detect user touch operations and the signals generated by the touch operations, convert these signals into touch point coordinates, and send them to the processor 8010. It can also receive and execute commands sent by the processor 8010. In addition, the touch panel 8051 can be implemented using various types, such as resistive, capacitive, infrared, and surface acoustic wave. Other input devices 8052 can include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control buttons, power buttons, etc.), a trackball, a mouse, a joystick, etc.

[0233] Of course, the touch panel 8051 can cover the display panel 8041. When the touch panel 8051 detects a touch operation on or near it, it transmits it to the processor 8010 to determine the type of touch event. Then the processor 8010 provides corresponding visual output on the display panel 8041 according to the type of touch event. Figure 8 In the embodiment, the touch panel 8051 and the display panel 8041 are two independent components to realize the input and output functions of the electronic device 8000, but in some embodiments, the touch panel 8051 and the display panel 8041 can be integrated to realize the input and output functions of the electronic device 8000.

[0234] The electronic device 8000 may also include one or more sensors, such as a pressure sensor, a gravity acceleration sensor, a proximity light sensor, etc. Of course, according to the needs of specific applications, the electronic device 8000 may also include other components such as a camera. Since these components are not the key components used in the embodiments of this application, Figure 8 It is not shown and will not be described in detail.

[0235] Those skilled in the art will understand that Figure 8 The electronic device is merely an example and does not limit the electronic device. The electronic device may include more or fewer components than shown in the figure, or may include a combination of certain components or different components.

[0236] In an embodiment of the present application, a computer-readable storage medium stores a computer program. When the computer program is executed by a processor, a communication device can perform each step in the above embodiment.

[0237] For the convenience of description, the above parts are divided into modules (or units) according to their functions and described separately. Of course, when implementing this application, the functions of each module (or unit) can be implemented in the same or multiple software or hardware.

[0238] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0239] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0240] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0241] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0242] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0243] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A method for flow detection, characterized in that: include: Constructing a topology map based on the network address information and port information of the transmission data to be detected, wherein the network nodes in the topology map are constructed according to the network address information and the port information; generating edge feature vectors corresponding to respective edges in the topology graph according to transmission association information of respective transmission data; the edges in the topology graph are generated based on connections between respective network nodes; Obtaining flow detection results corresponding to each edge in the topology graph based on the topology graph, the feature vectors of each edge, and a pre-trained flow detection model, wherein the flow detection model is constructed based on a graph neural network and residual connections; The flow detection model is trained by the following steps: Based on the training data, construct a topological graph sample and an edge feature vector corresponding to each edge in the topological graph sample; Input the topology map sample and the feature vectors of each edge into the graph neural network model to obtain the flow detection results corresponding to each edge in the topology map sample; Obtaining sample labels for each edge based on the training data; Determine the model loss based on the traffic detection results and sample labels corresponding to each edge; Adjusting the parameters of the graph neural network model according to the model loss until a traffic detection model that meets the training conditions is obtained; The step of inputting the topology graph sample and each edge feature vector into a graph neural network model to obtain a flow detection result corresponding to each edge in the topology graph sample includes: Generate node feature vectors corresponding to each network node based on the IP address and port corresponding to each network node in the topology sample; Based on the feature vectors of each node and each edge, a convolution operation is performed to obtain the feature vectors of each edge after the convolution operation; According to the feature vector of each edge after the convolution operation, the malicious traffic probability of each edge is obtained; According to the malicious traffic probability of each edge, the traffic detection results of each edge are obtained.

2. The method according to claim 1, wherein The network address information includes a source Internet Protocol (IP) address and a destination IP address, the port information includes a source port and a destination port, the network nodes include a source node and a destination node, and constructing a topology map based on the network address information and port information of the transmission data to be detected includes: According to the source IP address and source port in each transmission data, the source node corresponding to each transmission data is constructed; According to the destination IP address and destination port in each transmission data, the destination node corresponding to each transmission data is constructed; The source node and the destination node corresponding to each transmission data are connected to obtain the topology diagram.

3. The method according to claim 1, wherein The convolution operation is performed based on each node feature vector and each edge feature vector to obtain each edge feature vector after the convolution operation, including: The following steps are executed repeatedly until the convolution operation conditions are met: For a target node in each node, generating an aggregation vector of the target node based on edge feature vectors corresponding to the target node and adjacent nodes, the target node being any node in each node; Obtaining a new node feature vector of the target node according to the node feature vector and the aggregation vector of the target node; For the first node and the second node in each node, based on the new node feature vector of the first node, the new node feature vector of the second node, and the edge feature vectors corresponding to the first node and the second node, obtain the new edge feature vectors corresponding to the first node and the second node; the first node and the second node are any two adjacent network nodes in each node.

4. The method according to claim 3, wherein Generating an aggregation vector of the target node based on edge feature vectors corresponding to the target node and adjacent nodes includes: Filtering a set number of adjacent nodes from the adjacent nodes of the target node; An average operation is performed on the edge feature vectors corresponding to the target node and the screened adjacent nodes to obtain the aggregate vector.

5. The method according to claim 3 or 4, wherein: The obtaining, according to the node feature vector and the aggregation vector of the target node, a new node feature vector of the target node includes: Concatenate the node feature vector and the aggregation vector of the target node to obtain a first concatenated vector; The new node feature vector is obtained based on the first concatenated vector.

6. The method according to claim 3 or 4, wherein: The obtaining, based on the new node feature vector of the first node, the new node feature vector of the second node, and the edge feature vectors corresponding to the first node and the second node, new edge feature vectors corresponding to the first node and the second node includes: Concatenate the new node feature vector of the first node, the new node feature vector of the second node, and the edge feature vectors corresponding to the first node and the second node to obtain a second concatenation vector; The new edge feature vector is obtained according to the second concatenated vector.

7. A flow detection device, characterized in that: include: A construction unit, configured to construct a topology map based on the network address information and port information of the transmission data to be detected, wherein the network nodes in the topology map are constructed according to the network address information and the port information; A generating unit, configured to generate an edge feature vector corresponding to each edge in the topology graph according to transmission association information of each transmission data; the edges in the topology graph are generated based on connections between each network node; an obtaining unit, configured to obtain, based on the topological graph, the feature vectors of each edge, and a pre-trained traffic detection model, a traffic detection result corresponding to each edge in the topological graph, wherein the traffic detection model is constructed based on a graph neural network and residual connections; The obtaining unit is further configured to: The flow detection model is trained using the following steps: Based on the training data, construct a topological graph sample and an edge feature vector corresponding to each edge in the topological graph sample; Input the topology map sample and the feature vectors of each edge into the graph neural network model to obtain the flow detection results corresponding to each edge in the topology map sample; Obtaining sample labels for each edge based on the training data; Determine the model loss based on the traffic detection results and sample labels corresponding to each edge; Adjusting the parameters of the graph neural network model according to the model loss until a traffic detection model that meets the training conditions is obtained; The obtaining unit is further configured to: Generate node feature vectors corresponding to each network node based on the IP address and port corresponding to each network node in the topology sample; Based on the feature vectors of each node and each edge, a convolution operation is performed to obtain the feature vectors of each edge after the convolution operation; According to the feature vector of each edge after the convolution operation, the malicious traffic probability of each edge is obtained; According to the malicious traffic probability of each edge, the traffic detection results of each edge are obtained.

8. The device according to claim 7, wherein The network address information includes a source Internet Protocol (IP) address and a destination IP address, the port information includes a source port and a destination port, the network node includes a source node and a destination node, and the construction unit is used to: According to the source IP address and source port in each transmission data, the source node corresponding to each transmission data is constructed; According to the destination IP address and destination port in each transmission data, the destination node corresponding to each transmission data is constructed; The source node and the destination node corresponding to each transmission data are connected to obtain the topology diagram.

9. The device according to claim 7, wherein The obtaining unit is further configured to: The following steps are executed repeatedly until the convolution operation conditions are met: For a target node in each node, generating an aggregation vector of the target node based on edge feature vectors corresponding to the target node and adjacent nodes, the target node being any node in each node; Obtaining a new node feature vector of the target node according to the node feature vector and the aggregation vector of the target node; For the first node and the second node in each node, based on the new node feature vector of the first node, the new node feature vector of the second node, and the edge feature vectors corresponding to the first node and the second node, obtain the new edge feature vectors corresponding to the first node and the second node; the first node and the second node are any two adjacent network nodes in each node.

10. The device according to claim 9, wherein The obtaining unit is further configured to: Filtering a set number of adjacent nodes from the adjacent nodes of the target node; An average operation is performed on the edge feature vectors corresponding to the target node and the screened adjacent nodes to obtain the aggregate vector.

11. The device according to claim 9 or 10, characterized in that The obtaining unit is further configured to: Concatenate the node feature vector and the aggregation vector of the target node to obtain a first concatenated vector; The new node feature vector is obtained based on the first concatenated vector.

12. The device according to claim 9 or 10, characterized in that The obtaining unit is further configured to: Concatenate the new node feature vector of the first node, the new node feature vector of the second node, and the edge feature vectors corresponding to the first node and the second node to obtain a second concatenation vector; The new edge feature vector is obtained according to the second concatenated vector.

13. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, the method according to any one of claims 1 to 6 is executed.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is executed.

Images