A high-precision service identification method and system based on a graph convolutional neural network

Abstract

This invention discloses a high-precision service identification method and system based on graph convolutional neural networks, belonging to the field of communication network technology. The method mainly includes two aspects: data processing and machine learning. It captures traffic data packets generated by terminal devices using network packet capture tools, processes them into the data format required by the machine learning model, and inputs them into the machine learning module for training using a graph convolutional neural network model. In the application stage of the model, an adversarial generative network is incorporated for optimization. The optimal solution is obtained through adversarial game between the generative network and the discriminant network, thereby improving the accuracy of service identification. This solution solves the problems of traditional service identification methods failing to identify encrypted traffic and having low accuracy.

Description

Technical Field

[0001] This invention belongs to the field of communication network technology, specifically relating to a high-precision service identification method and system based on graph convolutional neural networks. Background Technology

[0002] With the proliferation of network technologies and applications, network users are demanding increasingly higher network quality and speeds. This presents significant challenges for network operators, including the rational allocation of network resources, the deployment of quality of service control mechanisms, the optimization of network infrastructure, and the improvement of user satisfaction. Furthermore, while encrypted traffic protects user privacy, it also provides a mask for intruders. Therefore, in terms of network security, differentiating network services, identifying unknown protocols, and detecting abnormal traffic are crucial for enabling timely responses to network intruders.

[0003] Traditional service type identification methods include those based on network port mapping, payload analysis, and behavioral characteristics. Network port mapping identifies different network applications by detecting the source and destination port numbers of network packets and mapping them to the port numbers used by the corresponding network protocols or applications. However, with the development of networks, the one-to-one correspondence between port numbers and applications is no longer always possible, leading to a decline in the accuracy and reliability of this method. Payload analysis determines network service categories by analyzing whether the payload in network packets matches a feature recognition library. This method requires establishing a network application layer feature recognition rule library and analyzing key control information in the payload to verify whether it matches a specific feature recognition rule in the library, thus determining the network application type. Behavioral characteristics-based methods leverage the different communication behavior patterns of different network applications, analyzing macroscopic behavioral differences in transmission connection modes such as host connections, network protocol usage, and average packet size in network flows to solve traffic classification problems. However, both methods have high system time and space overhead and poor real-time recognition performance. Furthermore, with the popularization of encryption protocols in recent years, these methods have gradually become limited. Summary of the Invention

[0004] The technical problem to be solved by this invention is that traditional business identification methods cannot identify encrypted traffic and have low identification accuracy.

[0005] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0006] A high-precision service identification method based on graph convolutional neural networks, for network service data requested by a terminal, performs the following process to identify the service type of the network service data requested by the terminal and obtain the service type to which the network service data requested by the terminal belongs:

[0007] Step A: For the network service data requested by the terminal, obtain a preset number of bytes of data from the network service data;

[0008] Step B: For a preset number of bytes of data in the network service data, convert the preset number of bytes of data into two-dimensional matrix data;

[0009] Step C: Based on the two-dimensional matrix data corresponding to the network service data requested by the terminal, and combined with the preset service types, use a pre-trained service identification model that takes the two-dimensional matrix data corresponding to the network service data as input and the service type corresponding to the network service data as output; perform service type identification on the network service data requested by the terminal to obtain the service type to which the network service data requested by the terminal belongs.

[0010] The pre-trained service recognition model, which takes two-dimensional matrix data corresponding to network service data as input and the service type corresponding to the network service data as output, is obtained by performing the following process through a service recognition model training system that includes a generation module, a discrimination module, and a recognition module:

[0011] Step 1: Obtain the network service dataset corresponding to each preset service type. For each network service data, obtain a preset number of bytes of data. Then, for the preset number of bytes of data in the network service data, convert the preset number of bytes of data into two-dimensional matrix data to construct the actual dataset.

[0012] Step 2: Based on the actual dataset, iteratively execute the following steps: train the generation, discrimination, and recognition modules based on their corresponding losses until the maximum number of iterations is reached or the loss values ​​of the generation, discrimination, and recognition modules stabilize, obtaining the optimal business recognition module training system. Then, use the recognition module from the optimal business recognition module training system as a pre-trained business recognition model that takes the two-dimensional matrix data corresponding to the network business data as input and the business type corresponding to the network business data as output.

[0013] Step 2.1: Input the two-dimensional matrix data from the actual dataset into the generation module, and combine it with random noise to obtain new network service data;

[0014] Step 2.2: Input the new network service data into the discrimination module to determine the sample category and obtain the loss of the discrimination module; the sample categories include: actual dataset samples and output samples from the generation module;

[0015] Step 2.3: Input the new network service data into the identification module, identify the service type based on the preset service types, and obtain the identification module loss;

[0016] Step 2.4: Based on the discriminant module loss and the identification module loss, the generation module loss is obtained;

[0017] Among them, the loss of the discrimination module The calculation expression is as follows:

[0018] ;

[0019] In the formula, E represents the expected function; x represents the actual dataset. This indicates the probability that the discrimination module classifies data x as a sample from the actual dataset; This indicates the probability that the discrimination module will classify the output data z of the generation module as the output sample of the generation module;

[0020] Loss of recognition module The calculation expression is as follows:

[0021] ;

[0022] In the formula, N represents the preset number of each business type; The symbol function indicates that if the input data z of the recognition module belongs to business type i, If the input data z of the recognition module does not belong to business type i, ; This represents the probability that the identification model predicts the business type i for input data z;

[0023] Module loss The calculation expression is as follows:

[0024] ;

[0025] in, and As a preset constant, To determine module loss, To identify module loss.

[0026] As a preferred embodiment of the present invention, the training of the generation module, the discrimination module, and the recognition module utilizes backpropagation and gradient descent techniques to optimize the parameters in the generation module, the discrimination module, and the recognition module based on the loss of the discrimination module and the loss of the recognition module.

[0027] As a preferred technical solution of the present invention, the recognition module is an initial service recognition model based on a dataset pre-trained with two-dimensional matrix data corresponding to network service data as input and service type corresponding to network service data as output.

[0028] As a preferred embodiment of the present invention, the service identification model employs a graph convolutional neural network.

[0029] As a preferred embodiment of the present invention, the graph convolutional neural network includes two convolutional layers.

[0030] A system for high-precision service recognition based on graph convolutional neural networks includes a data acquisition module, a byte extraction module, a data conversion module, and a data recognition module.

[0031] The data capture module is used to obtain network service data requested by the terminal;

[0032] The byte extraction module is used to extract a preset number of bytes of network service data from the network service data requested by the terminal.

[0033] The data conversion module is used to convert a preset number of bytes of data in network service data into two-dimensional matrix data.

[0034] The data recognition module uses a two-dimensional matrix of network service data requested by the terminal, combined with preset service types, and a pre-trained service recognition model that takes the two-dimensional matrix of network service data as input and the service type of the network service data as output; it performs service type recognition on the network service data requested by the terminal to obtain the service type to which the network service data requested by the terminal belongs.

[0035] The beneficial effects of this invention are as follows: This invention provides a high-precision service identification method and system based on graph convolutional neural networks. This solution leverages the excellent classification effect of graph convolutional neural networks on irregular data, thus employing a graph convolutional neural network service identification algorithm to identify various types of network services. Furthermore, due to the impurity of network data, adversarial neural networks are integrated to generate new data samples, further improving the identification accuracy of the graph convolutional neural network model. This method effectively solves the problems of traditional service identification methods being unable to identify encrypted traffic and having low identification accuracy. Attached Figure Description

[0036] Figure 1 This is a model diagram of a high-precision real-time service identification system in an embodiment of the present invention. Detailed Implementation

[0037] The present invention will be further described below with reference to the accompanying drawings. The following embodiments will enable those skilled in the art to more fully understand the present invention, but do not limit the present invention in any way.

[0038] like Figure 1 As shown, for network service data that needs to be identified in terms of service type, the first step is to perform a data capture stage. In this embodiment, the mobile phone is connected to the base station as a terminal device, the base station is connected to the MEC, and the MEC is connected to the router through a switch, enabling the terminal device to connect to the Internet. The mobile phone connects to the Internet. To ensure the uniqueness of the training data, only one application is run at a time. The data is captured by the automatic packet capture script on the MEC and sent to the PC.

[0039] Based on the captured network service data from terminal requests, a high-precision service identification method based on graph convolutional neural networks is used to perform the following process to identify the service type of the network service data requested by the terminal and obtain the service type to which the network service data requested by the terminal belongs.

[0040] Step A: For the network service data requested by the terminal, obtain a preset number of bytes of data from the network service data; specifically, in this embodiment, for the byte information of the captured network service data requested by the terminal, extract the first 256 bytes as service features for identification. If the data is less than 256 bytes, pad with 0; if the data exceeds 256 bytes, discard the remaining bytes.

[0041] Step B: For the preset number of bytes of data in the network service data, convert the preset number of bytes of data into two-dimensional matrix data; specifically: In this embodiment, since graph convolutional neural networks are generally used to process graph data, it is necessary to process the data using a Python script to convert the byte data into a 16*16 two-dimensional matrix as input to the service recognition model.

[0042] Step C: Based on the two-dimensional matrix data corresponding to the network service data requested by the terminal, and combined with the preset service types, use a pre-trained service identification model that takes the two-dimensional matrix data corresponding to the network service data as input and the service type corresponding to the network service data as output; perform service type identification on the network service data requested by the terminal to obtain the service type to which the network service data requested by the terminal belongs.

[0043] The business identification model employs a graph convolutional neural network (GCNN). The GCNN comprises two convolutional layers. In this embodiment, the GCNN includes a graph convolutional layer, a pooling layer, an activation function, and a fully connected layer. The convolutional layer multiplies each element of the two-dimensional matrix with the element at the same position in the convolution kernel, then sums the results to obtain the input and the output of the convolution. The input is the dataset transformed into a two-dimensional matrix, and the output is the output of the convolutional layer after the two-dimensional matrix convolution and an activation function. The pooling layer maps features into multiple adjacent small regions and simplifies them into a single value, reducing the training weights and data volume. Its input is the output of the convolutional layer. The fully connected layer establishes connections between each neuron in the next layer and all neurons in the previous layer, calculates the probability of each category using a softmax regression model, and finally transforms the data into the business type with the highest probability.

[0044] The formula for calculating the convolutional layer of a graph convolutional neural network is:

[0045]

[0046] Where W represents the weight matrix; Represents a self-connected adjacency matrix. , It is the identity matrix. The degree matrix represents the adjacency matrix of a self-join. The formula for calculating the degree matrix of a self-join is: , i refers to the row of the matrix, j refers to the column of the matrix; The features representing nodes are the features output by convolutional layer l; l represents the convolutional layer. This represents the loss function.

[0047] A single convolution may not accurately capture the features of the data samples, while three convolutions would be very time-consuming. Therefore, this embodiment uses a two-layer graph convolutional neural network, whose forward propagation formula is:

[0048]

[0049] Where Z represents the output of a two-layer graph convolutional neural network; This represents the normalized adjacency matrix of self-connected nodes. Represents the learnable weight parameters of the first graph convolutional layer, and ReLU represents the activation function. This represents the features extracted from each node after passing through the first graph convolutional layer. These represent the learnable weight parameters of the second graph convolutional layer. This represents the features extracted from each node after passing through the second graph convolutional layer. Ultimately, we need to predict the category of each node, which requires using the Softmax function of a fully connected layer to obtain the probability that each node belongs to each business type.

[0050] In step C, the pre-trained service recognition model, which takes the two-dimensional matrix data corresponding to the network service data as input and the service type corresponding to the network service data as output, is obtained by performing the following process through a service recognition model training system including a generation module, a discrimination module, and a recognition module.

[0051] Step 1: Obtain the network service dataset corresponding to each preset service type. For each network service data, obtain a preset number of bytes of data. Then, for the preset number of bytes of data in the network service data, convert the preset number of bytes of data into two-dimensional matrix data to construct the actual dataset.

[0052] Specifically, in this embodiment, the actual dataset is constructed through the following steps (ac).

[0053] Step a: Export the byte information of the captured dataset, extract the first 256 bytes as business features for identification. If the data is less than 256 bytes, pad it with 0. If the data exceeds 256 bytes, discard the remaining bytes.

[0054] Step b: Label the data accordingly. The preset business types corresponding to this embodiment include: Weibo, WeChat, QQ, Taobao, video, and music. Data is labeled according to different business types, using different numbers for differentiation. To ensure the test data is as pure as possible, only one mobile application is opened at a time, and it is allowed to run for a period of time before data is captured. The same amount of data is used for both the training and test sets for different business types. The dataset is shown in Table 1.

[0055] Table 1

[0056] Business type training set test set Label Weibo 100000 200000 0 WeChat 100000 200000 1 QQ 100000 200000 2 Taobao 100000 200000 3 video 100000 200000 4 music 100000 200000 5

[0057] Step c: Data transformation. Since graph convolutional neural networks are generally used to process graph data, it is necessary to process the data using a Python script to transform the labeled dataset into a 16*16 two-dimensional matrix as the input to the model.

[0058] Step 2: Based on the actual dataset, iteratively execute the following steps: train the generation, discrimination, and recognition modules based on their corresponding losses until the maximum number of iterations is reached or the loss values ​​of the generation, discrimination, and recognition modules stabilize, obtaining the optimal business recognition module training system. Then, use the recognition module from the optimal business recognition module training system as a pre-trained business recognition model that takes the two-dimensional matrix data corresponding to the network business data as input and the business type corresponding to the network business data as output.

[0059] Step 2.1: Input the two-dimensional matrix data from the actual dataset into the generation module, and combine it with random noise to obtain new network service data;

[0060] Step 2.2: Input the new network service data into the discrimination module to determine the sample categories and obtain the discrimination module loss; the sample categories include: actual dataset samples and output samples from the generation module; the discrimination module loss... The calculation expression is as follows:

[0061]

[0062] In the formula, E represents the expected function; x represents the actual dataset. This indicates the probability that the discrimination module classifies data x as a sample from the actual dataset; This indicates the probability that the discrimination module will classify the output data z of the generation module as a sample output by the generation module.

[0063] Step 2.3: Input the new network service data into the identification module, identify the service type based on preset service types, and obtain the identification module loss; the identification module loss The calculation expression is as follows:

[0064]

[0065] In the formula, N represents the preset number of each business type; The symbol function indicates that if the input data z of the recognition module belongs to business type i, If the input data to the recognition module does not belong to business type i, ; This represents the probability that the recognition model predicts whether the input data z belongs to business type i.

[0066] Step 2.4: Based on the discriminant module loss and the identification module loss, the generation module loss is obtained.

[0067] The calculation expression for the loss of the generation module is as follows:

[0068]

[0069] in, and A preset constant is used for weight adjustment. and The difference in magnitude allows the loss of the generation module to reach equilibrium. To determine module loss, To identify module loss.

[0070] The training of the generation module, discrimination module, and recognition module utilizes backpropagation and gradient descent techniques. Based on the loss of the discrimination module and the loss of the recognition module, the parameters in the generation module, discrimination module, and recognition module are optimized.

[0071] The recognition module is an initial service recognition model based on a pre-trained dataset, which takes a two-dimensional matrix of network service data as input and the service type corresponding to the network service data as output.

[0072] In this embodiment, the sample generation module is a generator network, and the discrimination module is a discriminator network, together forming an adversarial generative network. Random noise is passed through the generator network to generate new samples. This random noise is data other than the business types included in this scheme. The samples are then input into the discriminator network for discrimination. The discriminator network tries to distinguish the generated sample set from the actual sample set. Through continuous adversarial game between the discriminator network and the generator network, the generator network obtains the distribution pattern of the actual sample set and generates data that infinitely approximates the actual sample set. The processed dataset is then used as a training set and input into the adversarial generative network for training, thereby obtaining a certain number of datasets that infinitely approximate the real sample set. By further training the recognition model, the accuracy of the recognition model is improved.

[0073] In this embodiment, the graph convolutional neural network service recognition model designed in this solution was compared with some commonly used learning models. As shown in Table 2, this solution can more accurately identify the type of service.

[0074] Table 2

[0075] Serial Number Model Name accuracy 1 Random Forest 87.5% 2 Support Vector Machine 80% 3 CNN 95% 4 Graph Convolutional Neural Network 98%

[0076] Based on the above method, the trained model is deployed in the established environment. Data captured via MEC is processed by automated scripts into the format required by the model. The trained graph convolutional neural network model can then more accurately identify the type of business. This system provides a high-precision business identification method based on graph convolutional neural networks, including a data capture module, a byte extraction module, a data conversion module, and a data recognition module.

[0077] The data capture module is used to obtain network service data requested by the terminal;

[0078] The byte extraction module is used to extract a preset number of bytes of network service data from the network service data requested by the terminal.

[0079] The data conversion module is used to convert a preset number of bytes of data in network service data into two-dimensional matrix data.

[0080] The data recognition module uses a two-dimensional matrix of network service data requested by the terminal, combined with preset service types, and a pre-trained service recognition model that takes the two-dimensional matrix of network service data as input and the service type of the network service data as output; it performs service type recognition on the network service data requested by the terminal to obtain the service type to which the network service data requested by the terminal belongs.

[0081] This invention designs a high-precision service identification method and system based on graph convolutional neural networks. The method mainly includes two aspects: a data processing module and a machine learning module. Traffic data packets generated by terminal devices are captured using network packet capture tools, processed into the data format required by the machine learning model, and then input into the machine learning module for training using a graph convolutional neural network model. In the application stage of the model, a generative adversarial network is incorporated for optimization. The optimal solution is obtained through adversarial game between the generator network and the discriminator network, thereby improving the accuracy of service identification. This solution solves the problems of traditional service identification methods, such as their inability to identify encrypted traffic and low accuracy.

[0082] The above are merely preferred embodiments of the present invention, but do not limit the patent scope of the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of the present invention specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the patent protection scope of the present invention.

Claims

1. A high-precision service identification method based on a graph convolutional neural network, characterized by: For network service data requested by a terminal, the following procedure is performed to identify the service type of the requested network service data and obtain the service type to which the requested network service data belongs: Step A: For the network service data requested by the terminal, obtain a preset number of bytes of data from the network service data, wherein the network service data is encrypted traffic; Step B: For a preset number of bytes of data in the network service data, convert the preset number of bytes of data into two-dimensional matrix data; Step C: Based on the two-dimensional matrix data corresponding to the network service data requested by the terminal, and combined with the preset service types, use a pre-trained service identification model that takes the two-dimensional matrix data corresponding to the network service data as input and the service type corresponding to the network service data as output; perform service type identification on the network service data requested by the terminal to obtain the service type to which the network service data requested by the terminal belongs. The pre-trained service recognition model, which takes two-dimensional matrix data corresponding to network service data as input and the service type corresponding to the network service data as output, is obtained by performing the following process through a service recognition model training system that includes a generation module, a discrimination module, and a recognition module: Step 1: Obtain the network service dataset corresponding to each preset service type. For each network service data, obtain a preset number of bytes of data. Then, for the preset number of bytes of data in the network service data, convert the preset number of bytes of data into two-dimensional matrix data to construct the actual dataset. Step 2: Based on the actual dataset, iteratively execute the following steps: train the generation, discrimination, and recognition modules based on their corresponding losses until the maximum number of iterations is reached or the loss values ​​of the generation, discrimination, and recognition modules stabilize, obtaining the optimal business recognition module training system. Then, use the recognition module from the optimal business recognition module training system as a pre-trained business recognition model that takes the two-dimensional matrix data corresponding to the network business data as input and the business type corresponding to the network business data as output. Step 2.1: Input the two-dimensional matrix data from the actual dataset into the generation module, and combine it with random noise to obtain new network service data; Step 2.2: Input the new network service data into the discrimination module to determine the sample category and obtain the loss of the discrimination module; the sample categories include: actual dataset samples and output samples from the generation module; Step 2.3: Input the new network service data into the identification module, identify the service type based on the preset service types, and obtain the identification module loss; Step 2.4: Based on the discriminant module loss and the identification module loss, the generation module loss is obtained; Among them, the loss of the discrimination module The expression for calculation is as follows: ； In the formula, E represents the expected function; x represents the actual dataset. This indicates the probability that the discrimination module classifies data x as a sample from the actual dataset; This indicates the probability that the discrimination module will classify the output data z of the generation module as the output sample of the generation module; Loss of recognition module The calculation expression is as follows: ； In the formula, N represents the preset number of each business type; The symbol function indicates that if the input data z of the recognition module belongs to business type i, If the input data z of the recognition module does not belong to business type i, ; This represents the probability that the identification model predicts the business type i for input data z; Module loss The expression for calculation is as follows: ； in, and As a preset constant, To determine module loss, To identify module loss.

2. The high-precision service recognition method based on graph convolutional neural networks according to claim 1, characterized in that: The training of the generation module, discrimination module, and recognition module utilizes backpropagation and gradient descent techniques. Based on the loss of the discrimination module and the loss of the recognition module, the parameters in the generation module, discrimination module, and recognition module are optimized.

3. The high-precision service recognition method based on graph convolutional neural networks according to claim 1, characterized in that: The recognition module is an initial service recognition model based on a pre-trained dataset, which takes a two-dimensional matrix of network service data as input and the service type corresponding to the network service data as output.

4. The high-precision service recognition method based on graph convolutional neural networks according to claim 1, characterized in that: The business identification model uses a graph convolutional neural network.

5. The high-precision service recognition method based on graph convolutional neural networks according to claim 4, characterized in that: The graph convolutional neural network consists of two convolutional layers.

6. A system based on the high-precision service identification method based on graph convolutional neural networks as described in any one of claims 1-5, characterized in that: It includes a data capture module, a byte extraction module, a data conversion module, and a data recognition module. The data capture module is used to obtain network service data requested by the terminal; The byte extraction module is used to extract a preset number of bytes of data from the network service data requested by the terminal. The data conversion module is used to convert a preset number of bytes of data in network service data into two-dimensional matrix data. The data recognition module uses a two-dimensional matrix of network service data requested by the terminal, combined with preset service types, and a pre-trained service recognition model that takes the two-dimensional matrix of network service data as input and the service type of the network service data as output; it performs service type recognition on the network service data requested by the terminal to obtain the service type to which the network service data requested by the terminal belongs.

Images