DDoS detection methods, devices, equipment, and media based on graph neural networks

Abstract

This application discloses a method, apparatus, device, and medium for detecting distributed denial-of-service attacks based on graph neural networks, relating to the computer field. The method includes: identifying the graph structure data corresponding to the traffic to be detected using a trained graph neural network model; determining whether the traffic to be detected is distributed denial-of-service attack traffic based on the identification result; the model training process involves: acquiring target flow feature information from the target traffic and converting the target flow feature information into graph structure data; processing the graph structure data using a preset algorithm to obtain the processed result; the preset algorithm is used to aggregate the neighboring vertex information of each vertex in the graph structure data, and the processed result is obtained based on the aggregated information; and training the graph neural network model using the processed result. This application aggregates the neighboring vertex information of each vertex in the graph structure data using a preset algorithm, without needing to obtain the information of the entire graph structure data, thus solving the problems of overfitting and poor generalization ability.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, device, and medium for detecting distributed denial-of-service attacks based on graph neural networks. Background Technology

[0002] In recent years, Distributed Denial of Service (DDoS) attacks have become an extremely serious security threat in network security, posing a significant challenge to the information and property security of governments, enterprises, and even individuals, and thus have received widespread attention. DDoS attackers first scan the entire network to find hosts with protocol vulnerabilities or other problems. They then exploit these vulnerabilities to control a large number of hosts to simultaneously send various requests to the target, consuming the target's system resources and rendering the target unable to provide services to legitimate users. There are several types of DDoS attacks, which can be categorized by the target being denied: bandwidth-consuming attacks and resource-consuming attacks. Bandwidth-consuming attacks involve a large influx of data packets to the victim host, exhausting its network access bandwidth. Resource-consuming attacks involve the victim host's system resources (storage and computing resources) being heavily consumed, even causing system crashes. These two types of attacks can occur individually or simultaneously. Common DDoS attacks include TCP SYN FLOOD attacks, ACK FLOOD attacks, ICMP attacks, and UDP FLOOD attacks.

[0003] In the field of deep learning, Graph Neural Networks (GNNs) have become a research hotspot at major deep learning conferences and have received widespread attention. While machine learning algorithms have corresponding applications in processing structured data such as speech, images, and text, unstructured data, such as social networks, knowledge graphs, network topologies, and complex file systems, are also problematic. GNNs' outstanding ability to process unstructured data has led to new breakthroughs in network data analysis, recommender systems, physical modeling, and natural language processing.

[0004] When the sample data is imbalanced, using traditional GNN processing requires training all vertices in the graph structure data to obtain the final model. This will lead to a decrease in the accuracy of the data, and in turn, problems such as overfitting and poor generalization ability.

[0005] Therefore, how to ensure data accuracy and avoid overfitting and poor generalization when sample data is imbalanced is a problem that needs to be explored by those skilled in the art. Summary of the Invention

[0006] In view of this, the purpose of this invention is to provide a method, apparatus, device, and medium for detecting distributed denial-of-service attacks based on graph neural networks, which can ensure data accuracy even when sample data is imbalanced, thereby avoiding the problems of overfitting and poor generalization ability. The specific solution is as follows:

[0007] Firstly, this application discloses a distributed denial-of-service attack detection method based on graph neural networks, including:

[0008] The trained graph neural network model is used to identify the graph structure data to be detected corresponding to the traffic to be detected;

[0009] Based on the identification results, determine whether the traffic to be detected is distributed denial-of-service attack traffic;

[0010] The training process of the graph neural network model includes:

[0011] Obtain target flow feature information from the target traffic and convert the target flow feature information into graph structure data; the target traffic includes normal traffic and distributed denial-of-service attack traffic;

[0012] The graph structure data is processed using a preset algorithm to obtain a processed result; the preset algorithm is used to aggregate the information of the neighboring vertices of each vertex in the graph structure data, and the processed result is obtained based on the aggregated information;

[0013] The processed results are used to train a graph neural network model, resulting in the trained graph neural network model.

[0014] Optionally, obtaining the target flow feature information in the target traffic includes:

[0015] The target traffic generated during the communication between multiple hosts is obtained using packet capture tools, and the initial flow characteristic information of the target traffic is extracted.

[0016] The initial flow feature information of the target traffic is cleaned and normalized to obtain the target flow feature information in the target traffic.

[0017] Optionally, converting the target flow feature information into graph structure data includes:

[0018] The first target flow feature information in the target flow feature information is transformed into each vertex in the graph structure data; the first target flow feature information is the address and port feature information of multiple hosts;

[0019] The second target flow feature information in the target flow feature information is converted into an edge in the graph structure data; the second target flow feature information is other flow feature information other than the first target flow feature information in the target flow feature information.

[0020] Optionally, the step of processing the graph structure data using a preset algorithm to obtain the processed result includes:

[0021] The neighboring vertices of each vertex in the graph structure data are sampled; the neighboring vertices of each vertex are the vertices that communicate with each vertex.

[0022] Using the preset algorithm, the information of the neighboring vertices of each vertex is aggregated, and the weight of the neighboring vertices of each vertex is determined based on the aggregated information to obtain the processing result;

[0023] Accordingly, training the graph neural network model using the processed result includes:

[0024] The graph neural network model is trained using the weights of the neighboring vertices of each vertex.

[0025] Optionally, determining the weights of the neighboring vertices of each vertex based on the aggregated information to obtain the processing result includes:

[0026] The characteristics of the neighboring vertices of each vertex are determined based on the aggregated information;

[0027] The processing result is obtained by assigning corresponding weights to the neighboring vertices of each vertex based on their characteristics.

[0028] Optionally, the step of processing the graph structure data using a preset algorithm to obtain the processed result includes:

[0029] The graph structure data is processed using the E-EesGAT algorithm or the GraphSAGE algorithm to obtain the processed result.

[0030] Optionally, the step of using the trained graph neural network model to identify the graph structure data to be detected corresponding to the traffic to be detected, and determining whether the traffic to be detected is distributed denial-of-service attack traffic based on the identification result, includes:

[0031] The trained graph neural network model is used to identify the graph structure data to be detected corresponding to the traffic to be detected, so as to obtain the global representation information of the graph structure data to be detected.

[0032] Calculate the category probability of the graph structure data to be detected based on the global representation information;

[0033] If the category probability is greater than the preset category probability threshold, the traffic to be detected is determined to be distributed denial-of-service attack traffic.

[0034] If the category probability is not greater than the preset category probability threshold, then the traffic to be detected is determined not to be distributed denial-of-service attack traffic.

[0035] Secondly, this application discloses a distributed denial-of-service attack detection device based on graph neural networks, comprising:

[0036] The identification module is used to identify the graph structure data to be detected corresponding to the traffic to be detected using the trained graph neural network model;

[0037] The judgment module is used to determine whether the traffic to be detected is distributed denial-of-service attack traffic based on the identification result;

[0038] Graph Neural Network Model Training Module: This module acquires target flow feature information from target traffic and transforms the target flow feature information into graph structure data. The target traffic includes normal traffic and distributed denial-of-service (DDoS) attack traffic. A preset algorithm is used to process the graph structure data to obtain a processed result. The preset algorithm aggregates information about the neighboring vertices of each vertex in the graph structure data, and the processed result is obtained based on the aggregated information. The processed result is used to train a graph neural network model, resulting in the trained graph neural network model.

[0039] Thirdly, this application discloses an electronic device, including:

[0040] Memory, used to store computer programs;

[0041] A processor is used to execute the computer program to implement the aforementioned disclosed distributed denial-of-service attack detection method based on graph neural networks.

[0042] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned distributed denial-of-service attack detection method based on graph neural networks.

[0043] Therefore, this application proposes a distributed denial-of-service (DDoS) attack detection method based on graph neural networks, comprising: using a trained graph neural network model to identify the graph structure data to be detected corresponding to the traffic to be detected; determining whether the traffic to be detected is DDoS attack traffic based on the identification result; the graph neural network model training process includes: acquiring target flow feature information in the target traffic and converting the target flow feature information into graph structure data; the target traffic includes normal traffic and DDoS attack traffic; processing the graph structure data using a preset algorithm to obtain a processed result; the preset algorithm is used to aggregate the information of the neighboring vertices of each vertex in the graph structure data, and the processed result is the result obtained based on the aggregated information; training the graph neural network model using the processed result to obtain the trained graph neural network model. In summary, traditional GNNs require information about the entire graph structure during training. Therefore, if normal traffic is significantly greater than distributed denial-of-service attack traffic (i.e., when the class sample data is imbalanced), the accuracy of the trained model in detecting data will decrease, leading to a lack of generalization and overfitting. This application introduces a pre-defined algorithm from GNNs. Since this pre-defined algorithm does not require information about the entire graph structure, but only aggregates information about neighboring vertices, it effectively solves the problem of reduced data accuracy caused by imbalanced sample data. This further addresses the problems of overfitting and poor generalization caused by decreased data accuracy. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0045] Figure 1 This is a flowchart of a distributed denial-of-service attack detection method based on graph neural networks disclosed in this application;

[0046] Figure 2 This application discloses a specific flowchart of a distributed denial-of-service attack detection method based on graph neural networks.

[0047] Figure 3 This is a schematic diagram of the structure of a distributed denial-of-service attack detection device based on graph neural networks disclosed in this application;

[0048] Figure 4 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0049] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0050] When the sample data is imbalanced, using traditional GNN processing requires training all vertices of the graph structure data to obtain the final model. This will lead to a decrease in the accuracy of the data, and in turn, problems such as overfitting and poor generalization ability.

[0051] To address this, this application proposes a distributed denial-of-service attack detection scheme based on graph neural networks, which can ensure data accuracy even when sample data is imbalanced, thereby avoiding problems such as overfitting and poor generalization ability.

[0052] This application discloses a distributed denial-of-service attack detection method based on graph neural networks. See [link to relevant documentation]. Figure 1 As shown, the method includes:

[0053] Step S11: Use the trained graph neural network model to identify the graph structure data to be detected corresponding to the traffic to be detected.

[0054] In this embodiment, the training process of the trained graph neural network model specifically includes: acquiring target flow feature information in the target traffic and converting the target flow feature information into graph structure data; the target traffic includes normal traffic and distributed denial-of-service attack traffic; processing the graph structure data using a preset algorithm to obtain the processed result; the preset algorithm is used to aggregate the information of the neighboring vertices of each vertex in the graph structure data, and the processed result is the result obtained based on the aggregated information; training the graph neural network model using the processed result to obtain the trained graph neural network model.

[0055] Specifically, obtaining target flow feature information from target traffic may include: using a packet capture tool (such as gopacket) to capture target traffic generated during communication between multiple hosts, saving the target traffic as a PCAP file, and then extracting the initial flow feature information of the target traffic from the PCAP file; then cleaning and normalizing the initial flow feature information of the target traffic to obtain the target flow feature information within the target traffic. In this embodiment, the purpose of cleaning is to discard invalid flow feature information that may be generated during the extraction process, and the purpose of normalization is to make the data more accurate.

[0056] After determining the target flow feature information, the target flow feature information is converted into graph structure data. Since graph structure data is composed of edges and vertices, in this embodiment, the first target flow feature information in the target flow feature information is converted into each vertex in the graph structure data; the first target flow feature information is the address (IP address) and port feature information of multiple hosts; the second target flow feature information in the target flow feature information is converted into edges in the graph structure data; the second target flow feature information is other flow feature information in the target flow feature information besides the first target flow feature information.

[0057] Furthermore, after obtaining the graph structure data, the graph structure data is processed using a preset algorithm to obtain the processed result. Specifically, this includes sampling the neighboring vertices of each vertex in the graph structure data. For example, assuming that vertex a in the graph structure data communicates with vertices b and c respectively, for vertex a, the sampled neighboring vertices are vertices b and c, and vertex b is the first-level neighboring vertex of vertex a, and vertex c is the second-level neighboring vertex of vertex a. For vertex b, the sampled neighboring vertex is vertex a, and for vertex c, the sampled neighboring vertex is vertex a. In this way, the neighboring vertices of each vertex are obtained. That is, the vertices that communicate with each of the aforementioned vertices are obtained; further, after obtaining the neighboring vertices of each of the aforementioned vertices, the information of the neighboring vertices of each of the aforementioned vertices is aggregated using the preset algorithm, and the weights of the neighboring vertices of each of the aforementioned vertices are determined based on the aggregated information to obtain the processing result. Specifically, the features of the neighboring vertices of each of the aforementioned vertices are determined based on the aggregated information; corresponding weights are assigned to the neighboring vertices of each of the aforementioned vertices based on the features of the neighboring vertices of each of the aforementioned vertices to obtain the processing result; finally, after determining the weights of the neighboring vertices of each of the aforementioned vertices, a graph neural network model is trained using the weights of the neighboring vertices of each of the aforementioned vertices.

[0058] Furthermore, in this embodiment, the traffic to be detected is obtained, and the traffic to be detected is converted into graph structure data according to the method for converting traffic into graph structure data disclosed above. Then, the trained graph neural network model is used to identify the graph structure data to be detected corresponding to the traffic to be detected.

[0059] Step S12: Determine whether the traffic to be detected is a distributed denial-of-service attack based on the identification result.

[0060] In this embodiment, determining whether the traffic to be detected is distributed denial-of-service (DDoS) attack traffic based on the identification result specifically includes: using a trained graph neural network model to identify the graph structure data to be detected corresponding to the traffic to be detected, obtaining global representation information of the graph structure data to be detected; calculating the category probability of the graph structure data to be detected based on the global representation information; if the category probability is greater than a preset category probability threshold, then the traffic to be detected is determined to be DDoS attack traffic; if the category probability is not greater than the preset category probability threshold, then the traffic to be detected is determined not to be DDoS attack traffic. The global representation information is an intermediate product obtained after the graph structure data is processed by the graph neural network model. The category probability can be calculated after obtaining global representation information of a large amount of different graph structure data.

[0061] Therefore, this application proposes a distributed denial-of-service (DDoS) attack detection method based on graph neural networks, comprising: using a trained graph neural network model to identify the graph structure data to be detected corresponding to the traffic to be detected; determining whether the traffic to be detected is DDoS attack traffic based on the identification result; the graph neural network model training process includes: acquiring target flow feature information in the target traffic and converting the target flow feature information into graph structure data; the target traffic includes normal traffic and DDoS attack traffic; processing the graph structure data using a preset algorithm to obtain a processed result; the preset algorithm is used to aggregate the information of the neighboring vertices of each vertex in the graph structure data, and the processed result is the result obtained based on the aggregated information; training the graph neural network model using the processed result to obtain the trained graph neural network model. In summary, traditional GNNs require information about the entire graph structure during training. Therefore, if normal traffic is significantly greater than distributed denial-of-service attack traffic (i.e., when the class sample data is imbalanced), the accuracy of the trained model in detecting data will decrease, leading to a lack of generalization and overfitting. This application introduces a pre-defined algorithm from GNNs. Since this pre-defined algorithm does not require information about the entire graph structure, but only aggregates information about neighboring vertices, it effectively solves the problem of reduced data accuracy caused by imbalanced sample data. This further addresses the problems of overfitting and poor generalization caused by decreased data accuracy.

[0062] Specifically, the preset algorithm includes the GraphSAGE algorithm or the E-EesGAT algorithm. In one specific implementation, the preset algorithm is the GraphSAGE algorithm, which aggregates the information of the neighboring vertices of each vertex in the graph structure data. Since the GraphSAGE algorithm does not need to obtain the information of the entire graph structure data, but only needs to aggregate the information of the neighboring vertices and consider different weights for different neighboring vertices, and then focuses on learning the neighboring nodes with high weights, it effectively solves the problem of reduced data accuracy caused by imbalanced sample data, and further solves the problems of overfitting and poor generalization ability caused by the decrease in data accuracy.

[0063] It should be noted that traditional GNN models for distributed denial-of-service attack detection require storing the adjacency matrix and feature matrix together in memory or GPU memory. This is impractical for large-scale graph data, leading to memory explosion and slow convergence speed, making it unsuitable for large-scale graph data. To address this, this application introduces the E-EesGAT algorithm. Since the E-EesGAT algorithm first randomly samples a fixed-size subset of the graph data, the data size is reduced, eliminating the need to store all data in memory. This solves the memory explosion and slow convergence speed problems of traditional GNN models, making them unsuitable for large-scale graph data. Furthermore, because the subset random sampling uses a sampling method with replacement, controlling the size of the subset random sampling within a preset range does not affect the model's accuracy; on the contrary, it improves the convergence speed and reduces memory pressure.

[0064] When the preset algorithm is the E-EesGAT algorithm, this application can specifically include the following:

[0065] 1. Using a packet capture tool, the normal traffic and DDoS traffic generated in the experimental environment are saved in the form of PCAP files. It should be noted that the traffic involved in this application refers to the traffic generated during a single communication between two hosts.

[0066] 2. After acquiring the traffic, obtain 80 flow characteristic information from both normal traffic and DDoS traffic. See Table 1 for details of the flow characteristic information:

[0067] Table 1

[0068]

[0069]

[0070]

[0071] 3. Perform data cleaning and normalization on the extracted flow feature information; specifically, replace any invalid features that may be generated during the extraction process with 0, and normalize the 76 features other than the source IP address, source port, destination address and destination port respectively.

[0072] 4. The flow feature information is transformed into graph structure data G(V,E). In this graph structure data, every two directly connected vertices are determined by four flow feature information pieces: source IP address, source port, destination address, and destination port. The first two fields form a tuple to form the source node, and the last two fields form a tuple to form the destination node. The edges in the graph structure data are determined by other feature information in this flow feature information. It should be noted that actual graph structure data may include multiple vertices and multiple edges. Taking the communication between two hosts as an example, for instance, the source node (172.16.18.48:52962) and the destination node (192.168.2.34:80) exchange data. The remaining 76 flow feature information pieces are transformed into one edge of this graph structure data. This application defines the total sample set of the source and destination nodes as V, and the total sample set of the edges of the graph structure data as E.

[0073] 5. Using the E-EesGAT algorithm, a fixed-size subset of the graph structure data is first randomly sampled, and then the graph structure data after random sampling of the subset is processed.

[0074] Specifically, it includes:

[0075] 5.1. The E-EesGAT algorithm is used to randomly sample a fixed-size subset of the graph structure data, and the neighbor sampling function is used. Sampling is performed on the neighboring vertices of each vertex in the graph structure data obtained after random sampling; where B represents the sampling batch, k represents the number of samplings, and N represents the sampling number. v Represents the set of neighboring vertices.

[0076] 5.2 Aggregate the information contained in neighboring vertices using the aggregation function. The process of aggregating the k-th layer features of node v using the aggregation function is as follows:

[0077]

[0078] Where || represents the concatenation operator; This represents the features of the k-th layer of node v, that is, the features of the k-th layer neighbor vertices of node v; The characteristics of the (k-1)th level neighbor nodes of node u are represented by the node. u Let be the neighboring nodes of node v; W represents the weight matrix of the neighboring nodes; e v Represents the input edge features; W' represents the edge weight matrix; αuv Representing edge e uv The attention coefficient, which is also the influence coefficient of node u on the node; α uv It can be achieved through a feedforward neural network α[Wh u ||Wh v [To perform learning, where α represents the weight vector; h] u and h v These represent the hidden layer states of nodes u and v, respectively. Hidden layers are typically used to represent the features of nodes; attention coefficient α uv It can be expressed by the following formula:

[0079]

[0080] Where LeakyReLU represents the activation function; h i This represents the hidden state of the nodes adjacent to node v, where i represents the node number, and N represents the hidden state of the nodes adjacent to node v. v This represents the set of indices of all nodes adjacent to node v.

[0081] Aggregate functions can be equivalently represented as:

[0082]

[0083] in, M represents the number of attention heads; W m This represents the m-th weight matrix; Let σ represent the m-th weight vector; σ represents the activation function. This means that for all neighboring nodes of node v, the weighted sum of their inputs at layer m is calculated, and the final result is transformed by an activation function to obtain the final result.

[0084] In summary, the characteristics of the neighboring vertices of each of the aforementioned vertices are determined.

[0085] 6. The trained graph neural network model consists of two layers of E-ResGAT, with six attention heads per layer for node classification. Multi-head attention helps the neural network capture richer feature information. The cross-entropy loss function is used, and the Adam optimizer is employed during the backward selection gradient descent propagation stage, with a learning rate of 0.01.

[0086] 7. Based on the trained graph neural network model, identify the graph structure data to be detected corresponding to the traffic to be detected, obtain the global representation information corresponding to the graph structure data, and calculate the category probability of the graph structure data based on the global representation information corresponding to each graph structure data. Furthermore, determine whether the traffic to be detected meets the characteristics of a DDoS attack by using the category probability.

[0087] Figure 2 Here is a flowchart of a specific distributed denial-of-service attack detection method based on graph neural networks disclosed in this application. See [link to flowchart]. Figure 2 As shown,

[0088] The traffic acquisition includes: acquiring normal traffic datasets and DDoS traffic datasets; traffic labels are the labels of the two different traffic datasets; traffic preprocessing specifically includes: cleaning and normalizing the flow feature information extracted from the normal traffic dataset and DDoS traffic dataset; the traffic features are the cleaned and normalized flow feature information; graph structure data is obtained by transforming the flow feature information. Specifically, the graph structure data includes nodes (vertices) and edges. Nodes include source nodes and destination nodes. The source node is determined by the flow feature information of the source IP address and the source port in the flow feature information. The destination node is composed of the flow feature information of the destination IP address and the destination port in the flow feature information. The edges are composed of flow feature information other than the flow features of the source IP address, source port, destination IP address, and destination port in the flow feature information; model training involves: iteratively training the graph neural network model to obtain the trained graph neural network model, and using the trained graph neural network model to identify the graph structure data to be detected in order to determine whether the traffic to be detected is DDoS traffic.

[0089] Accordingly, this application also discloses a distributed denial-of-service attack detection device based on graph neural networks, see [link to relevant documentation]. Figure 3 As shown, the device includes:

[0090] The identification module 11 is used to identify the graph structure data to be detected corresponding to the traffic to be detected using the trained graph neural network model;

[0091] The judgment module 12 is used to determine whether the traffic to be detected is distributed denial-of-service attack traffic based on the identification result;

[0092] Graph Neural Network Model Training Module 13: Used to acquire target flow feature information in target traffic and convert the target flow feature information into graph structure data; the target traffic includes normal traffic and distributed denial-of-service attack traffic; the graph structure data is processed using a preset algorithm to obtain the processed result; the preset algorithm is used to aggregate the information of the neighboring vertices of each vertex in the graph structure data, and the processed result is the result obtained based on the aggregated information; the graph neural network model is trained using the processed result to obtain the trained graph neural network model.

[0093] For more detailed information on the working process of each of the above modules, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0094] Therefore, this application proposes a distributed denial-of-service (DDoS) attack detection method based on graph neural networks, comprising: using a trained graph neural network model to identify the graph structure data to be detected corresponding to the traffic to be detected; determining whether the traffic to be detected is DDoS attack traffic based on the identification result; the graph neural network model training process includes: acquiring target flow feature information in the target traffic and converting the target flow feature information into graph structure data; the target traffic includes normal traffic and DDoS attack traffic; processing the graph structure data using a preset algorithm to obtain a processed result; the preset algorithm is used to aggregate the information of the neighboring vertices of each vertex in the graph structure data, and the processed result is the result obtained based on the aggregated information; training the graph neural network model using the processed result to obtain the trained graph neural network model. In summary, traditional GNNs require information about the entire graph structure during training. Therefore, if normal traffic is significantly greater than distributed denial-of-service attack traffic (i.e., when the class sample data is imbalanced), the accuracy of the trained model in detecting data will decrease, leading to a lack of generalization and overfitting. This application introduces a pre-defined algorithm from GNNs. Since this pre-defined algorithm does not require information about the entire graph structure, but only aggregates information about neighboring vertices, it effectively solves the problem of reduced data accuracy caused by imbalanced sample data. This further addresses the problems of overfitting and poor generalization caused by decreased data accuracy.

[0095] Furthermore, embodiments of this application also provide an electronic device. Figure 4 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0096] Figure 4 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a display screen 23, an input / output interface 24, a communication interface 25, a power supply 26, and a communication bus 27. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the distributed denial-of-service attack detection method based on graph neural networks disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0097] In this embodiment, the power supply 26 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 25 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 24 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0098] Furthermore, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk, or optical disk, etc. The resources stored thereon may include computer programs 221, and the storage method may be temporary storage or permanent storage. The computer programs 221 may include, in addition to computer programs capable of performing the graph neural network-based distributed denial-of-service attack detection method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, computer programs capable of performing other specific tasks.

[0099] Furthermore, embodiments of this application also disclose a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed distributed denial-of-service attack detection method based on graph neural networks.

[0100] For the specific steps of this method, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0101] The various embodiments in this application are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. For the same or similar parts between the various embodiments, refer to each other. As for the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and relevant parts can be referred to in the method section.

[0102] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0103] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0104] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0105] The above provides a detailed description of a distributed denial-of-service attack detection method, apparatus, device, and storage medium based on graph neural networks provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A distributed denial of service attack detection method based on a graph neural network, characterized in that, The application relates to a method for detecting distributed denial-of-service attack traffic. The method comprises the following steps: using a trained graph neural network model to identify the to-be-detected graph structure data corresponding to to-be-detected traffic; judging whether the to-be-detected traffic is distributed denial-of-service attack traffic according to the identification result; the graph neural network model training process comprises the following steps: obtaining target flow feature information in target traffic, and converting the target flow feature information into graph structure data; the target traffic comprises normal traffic and distributed denial-of-service attack traffic; processing the graph structure data by using a preset algorithm to obtain a processed result; the preset algorithm is used for aggregating information of neighbor vertices of each vertex in the graph structure data, and the processed result is a result obtained based on the aggregated information; training a graph neural network model by using the processed result to obtain a trained graph neural network model; wherein processing the graph structure data by using the preset algorithm to obtain the processed result comprises the following steps: The E-EesGAT algorithm is used for fixed-size subset random sampling of graph structure data, and a neighbor sampling function is used Each neighbor vertex of each vertex in the graph structure data obtained after random sampling is sampled. For a sampling batch, For the number of samplings, A set of neighbor vertices According to the aggregation function, the information contained in the neighbor vertices is aggregated to obtain the features of the neighbor vertices of each vertex; wherein the aggregation function is used to aggregate the nodes The process of the first layer features is as follows: ； wherein, denotes a concatenation operator; denotes a node of the first layer of neighbors of node is a neighbor node of node denotes a weight matrix of neighbor nodes; denotes an input edge feature; denotes a weight matrix of edges; denotes an attention coefficient of edge is learned by a feedforward neural network denotes a weight vector; and denote hidden layer states of node and node respectively.​​​ 2. The distributed denial of service attack detection method based on graph neural network according to claim 1, characterized in that, processing the graph structure data by using an E-EesGAT algorithm to obtain the processed result; wherein the process of processing by using the E-EesGAT algorithm comprises the following steps: the method comprises the following steps: obtaining target traffic generated in the communication process of a plurality of hosts by using a packet capture tool, and extracting initial flow feature information of the target traffic; 3. The distributed denial of service attack detection method based on graph neural network according to claim 2, characterized in that, cleaning and normalizing the initial flow feature information of the target traffic to obtain the target flow feature information in the target traffic. the method comprises the following steps: converting first target flow feature information in the target flow feature information into each vertex in the graph structure data; the first target flow feature information is address and port feature information of the plurality of hosts; 4. The distributed denial of service attack detection method based on graph neural network according to claim 3, characterized in that, converting second target flow feature information in the target flow feature information into an edge in the graph structure data; the second target flow feature information is other flow feature information in the target flow feature information except the first target flow feature information. the method comprises the following steps: sampling neighbor vertices of each vertex in the graph structure data; the neighbor vertices of each vertex are vertices in communication with each vertex; aggregating information of the neighbor vertices of each vertex by using the preset algorithm, and determining the weight of the neighbor vertices of each vertex according to the aggregated information to obtain the processed result; correspondingly, the method comprises the following steps:

5. The distributed denial of service attack detection method based on graph neural network according to claim 4, characterized in that, training the graph neural network model by using the weight of the neighbor vertices of each vertex. the method comprises the following steps: determining the features of the neighbor vertices of each vertex according to the aggregated information; allocating corresponding weights to the neighbor vertices of each vertex according to the features of the neighbor vertices of each vertex to obtain the processed result.

6. The distributed denial of service attack detection method based on a graph neural network according to any one of claims 1 to 5, characterized in that, The trained graph neural network model is used to identify the to-be-detected graph structure data corresponding to the to-be-detected traffic, and whether the to-be-detected traffic is distributed denial of service attack traffic is determined according to the identification result, comprising: The trained graph neural network model is used to identify the to-be-detected graph structure data corresponding to the to-be-detected traffic, and the global feature information of the to-be-detected graph structure data is obtained; According to the global feature information, the class probability of the to-be-detected graph structure data is calculated; When the class probability is greater than the preset class probability threshold, it is determined that the to-be-detected traffic is distributed denial of service attack traffic; When the class probability is not greater than the preset class probability threshold, it is determined that the to-be-detected traffic is not distributed denial of service attack traffic.

7. A distributed denial of service attack detection apparatus based on a graph neural network, characterized by, Comprising: An identification module for identifying to-be-detected graph structure data corresponding to to-be-detected traffic using a trained graph neural network model; A judgment module for determining whether the to-be-detected traffic is distributed denial of service attack traffic according to the identification result; A graph neural network model training module: for obtaining target flow feature information in target traffic, and converting the target flow feature information into graph structure data; the target traffic includes normal traffic and distributed denial of service attack traffic; The graph structure data is processed using a preset algorithm to obtain a processed result; The preset algorithm is used to aggregate the information of the neighbor vertices of each vertex in the graph structure data, and the processed result is a result obtained based on the aggregated information; the graph neural network model is trained using the processed result to obtain the trained graph neural network model; Wherein, the graph structure data is processed using a preset algorithm to obtain a processed result, comprising: The graph structure data is processed using an E-EesGAT algorithm to obtain a processed result; wherein, the process of processing using the E-EesGAT algorithm, comprising: The E-EesGAT algorithm is used for fixed-size subset random sampling of graph structure data, and a neighbor sampling function is used Each neighbor vertex of each vertex in the graph structure data obtained after random sampling is sampled. For sampling batches, For sampling times, A set of neighbor vertices According to the aggregation function, the information contained in the neighbor vertices is aggregated to obtain the features of the neighbor vertices of each vertex; wherein the aggregation function is used to aggregate the nodes The process of obtaining the features of the first layer of the nodes is as follows: ； wherein, denotes a concatenation operator; denotes a node of the first layer neighbor vertices of a node is a neighbor node of a node denotes a weight matrix of neighbor nodes; denotes an input edge feature; denotes a weight matrix of an edge; denotes an attention coefficient of an edge learns through a feedforward neural network denotes a weight vector; and denote hidden layer states of a node and a node respectively.​​​ 8. An electronic device, comprising: Comprising: A memory for saving a computer program; A processor for executing the computer program to implement the distributed denial of service attack detection method based on graph neural network according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, For saving a computer program; wherein, the computer program is executed by the processor to implement the distributed denial of service attack detection method based on graph neural network according to any one of claims 1 to 6.

Images