Method and device for identifying encrypted malicious flow based on space-time feature and attention mechanism

Abstract

The application relates to an encryption malicious flow recognition method and device based on space-time features and an attention mechanism, which comprises the following steps: performing data preprocessing on an original data flow to obtain an initial data flow; establishing a flow track topology graph according to the initial data flow; extracting key node features from the flow track graph to obtain a key node feature set; establishing a node-level space attention feature graph by using the key node feature set; extracting space features from the node-level space attention feature graph to obtain a space feature set; extracting time features of the space feature set from the space feature set to obtain a time feature set; fusing the space feature set and the time feature set to obtain a space-time feature set; performing weight distribution on the space-time feature set to obtain a model training feature set; training a deep learning model to obtain an encryption malicious flow recognition model, and identifying encryption malicious data flow by using the encryption malicious flow recognition model. The application can more comprehensively grasp flow features and improve the detection rate of encryption malicious flow.

Description

Technical Field

[0001] This invention relates to the field of network security, and specifically to a method and apparatus for identifying encrypted malicious streams based on spatiotemporal features and attention mechanisms. Background Technology

[0002] With the rapid development of internet services, cyberattacks, data breaches, and information theft have become major challenges to network security. Technologies for detecting and classifying such malicious traffic in networks are also increasing, and malware traffic classification is a crucial pillar of network intrusion detection systems. The explosive growth of traffic encryption has made port-based or signature-based methods for classifying malicious traffic impractical. Current technologies researching learning-based methods for classifying encrypted malicious traffic, mining statistical patterns in traffic behavior, and commonly utilizing various machine learning algorithms to identify malicious events, mean that the performance of these methods is determined by the features and the algorithm.

[0003] In the field of deep learning, deep learning algorithms are applied to network traffic classification, such as using CNNs to detect malicious traffic and the application of deep belief networks in network traffic classification. Researchers use multiple CNNs with convolutional kernels of different scales to process the spatial features of the data and combine them with LSTMs to extract temporal features. Applying LSTM to network traffic feature extraction can effectively extract temporal features. Although CNNs perform well in extracting spatial features of traffic, they are more suitable for processing Euclidean structured data such as images. Due to the structural limitations of the above algorithms, they cannot consider the relationships between flows during feature extraction. Network traffic data is usually one-dimensional, and the relationships between flows are more like a topological relationship. Since network traffic data itself also has potential temporal and spatial features, temporal features reflect current and past flows, while spatial features reflect the topological relationships between flows.

[0004] Graph Convolutional Neural Networks (GCNs) have achieved state-of-the-art performance in cybersecurity tasks such as network traffic classification and anomaly detection. GCNs are suitable for cybersecurity tasks because they can capture spatial information hidden in network topology and can generalize to topologies invisible when the network is dynamic. Compared to traditional neural networks, these models consider both graph topology and flow features. Researchers have transformed traditional traffic trajectory topology graphs into new traffic graphs and used GCN models for representation learning. However, some researchers have designed traffic classifiers based on GCNs and k-nearest neighbors. Their edge weights are the similarity of the five nearest neighbors selected by k-nearest neighbors (KNN). However, this approach heavily relies on KNN for graph quality, meaning the graph quality is inconsistent. Other researchers have used GCNs for botnet detection, where the network first generates botnet traffic by creating botnet connections that mix different real-world large-scale network traffic. Then, a graph convolutional network is applied to classify network nodes. The generated graph does not contain any flow and node features, only considering the topological information of the network connectivity graph. Furthermore, this method does not detect individual attack flows but is limited to detecting attack nodes, especially in the context of botnets. Summary of the Invention

[0005] To address the technical problems in existing technologies, such as insufficient consideration of the relationships between flows and the simplistic nature of deep learning models, this invention provides a method and apparatus for identifying encrypted malicious flows based on spatiotemporal features and attention mechanisms.

[0006] The technical solution of the present invention to solve the above-mentioned technical problems is as follows:

[0007] A method for identifying encrypted malicious streams based on spatiotemporal features and attention mechanisms includes the following steps:

[0008] The raw data stream is preprocessed to obtain an initial data stream in a unified format; wherein, the raw data stream includes a normal encrypted data stream and an encrypted malicious data stream, and the raw data stream is a PCAP file stream;

[0009] A traffic trajectory topology graph is established based on the initial data stream; wherein, the nodes of the traffic trajectory topology graph represent the initial data stream, and the edges of the traffic trajectory topology graph represent the IP hosts shared by the nodes at both ends of the edges of the traffic trajectory topology graph;

[0010] By using an attention mechanism, key node features of the initial data stream are extracted from the traffic trajectory topology map to obtain a key node feature set.

[0011] A node-level spatial attention feature map is constructed using the aforementioned key node feature set;

[0012] The spatial features of the key node feature set are extracted from the node-level spatial attention feature map using the SGC model to obtain the spatial feature set;

[0013] The temporal features of the spatial feature set are extracted from the spatial feature set using the BiLSTM model to obtain the temporal feature set;

[0014] The spatial feature set and the temporal feature set are fused to obtain a spatial-temporal feature set;

[0015] By using an attention mechanism, weights are assigned to the spatial-temporal feature set to obtain model training feature sets with different weights;

[0016] A deep learning model is trained using the feature set of the model to obtain an encrypted malicious stream identification model.

[0017] The encrypted malicious stream identification model is used to identify encrypted malicious data streams.

[0018] The beneficial effects of this invention are as follows: Firstly, the original pcap traffic files undergo data preprocessing such as traffic purification and imbalanced sample handling, avoiding irrelevant features from degrading model performance and efficiency, while also resolving the problem of imbalanced traffic samples. Secondly, by utilizing the attributes and temporal relationships between flows, a communication traffic interaction graph is constructed from the source and destination information of network traffic. Shallow and deep connection features of nodes are extracted separately, and the behavioral characteristics of network host nodes during communication are mined, achieving a more reasonable and effective ability to extract flow sequence and topology features. Simultaneously, a spatial attention mechanism for nodes is incorporated to reduce the burden on the model. Finally, an SGC-LSA encrypted malicious traffic identification framework integrating an attention mechanism is designed. This framework fully extracts the spatiotemporal evolution features of the network from complex traffic data using SGC and BiLSTM, while simultaneously utilizing an attention mechanism to filter key classification features, improving the detection rate and identification efficiency of encrypted malicious traffic.

[0019] Based on the above technical solution, the present invention can be further improved as follows.

[0020] Furthermore, the original data stream is preprocessed to obtain an initial data stream with a unified format, including the following steps:

[0021] Obtain statistical information of all PCAP files in the original data stream to obtain a statistical information data stream;

[0022] The normally encrypted traffic information and the maliciously encrypted traffic information in the statistical information data stream are adjusted to a 1:1 ratio to obtain a balanced data stream;

[0023] All data in the balanced data stream are standardized to obtain a standard data stream.

[0024] All data in the standard data stream is labeled to obtain the initial data stream.

[0025] Further, statistical information of all PCAP files in the original data stream is obtained to obtain a statistical information data stream, specifically including the following steps:

[0026] Remove the header information of all PCAP files from the original data stream to obtain the initial statistical data stream; wherein each PCAP file in the initial statistical data stream contains only statistical information about the PCAP file;

[0027] Duplicate PCAP files and empty PCAP files are removed from the initial statistical data stream to obtain an optimized statistical data stream;

[0028] The headers of all data in the optimized statistical data stream are removed or anonymized to obtain the statistical information data stream.

[0029] Furthermore, a traffic trajectory topology map is established based on the initial data stream, including the following steps:

[0030] An initial data flow network topology graph is established based on the initial data flow; wherein, the nodes of the initial data flow network topology graph represent the IP hosts, and the edges of the initial data flow network topology graph represent the initial data flow;

[0031] The initial data flow network topology is converted into the traffic trajectory topology.

[0032] Furthermore, by employing an attention mechanism, key node features of the initial data stream are extracted from the traffic trajectory topology graph to obtain a key node feature set, including the following steps:

[0033] The initial data stream with a public IP host is extracted from the traffic trajectory topology using an attention mechanism.

[0034] The key node feature set is obtained by extracting the key node features of the initial data stream from the initial data stream with a public IP host.

[0035] Furthermore, a node-level spatial attention feature map is established using the key node feature set, including the following steps:

[0036] The key node feature set is subjected to global average pooling to obtain an initial feature vector;

[0037] The initial feature vector is compressed and mapped to obtain the mapped feature vector;

[0038] The dimension of the mapped feature vector is increased, and the sigmoid function is used to stimulate the dimension of the mapped feature vector to obtain an attention graph;

[0039] Weights are assigned to the attention graph using an attention mechanism to obtain the node-level spatial attention feature map.

[0040] Furthermore, the spatial features of the key node feature set are extracted from the node-level spatial attention feature map using the SGC model to obtain the spatial feature set, including the following steps:

[0041] The SGC model is established; wherein the SGC model includes a linear classifier and multiple graph convolutional layers;

[0042] By utilizing multiple graph convolutional layers, node features in the node-level spatial attention feature map are learned to obtain node feature vectors;

[0043] The node feature vectors are input into the linear classifier for classification to obtain the spatial feature set.

[0044] Furthermore, the temporal features of the spatial feature set are extracted from the spatial feature set using a BiLSTM model to obtain the temporal feature set. The specific steps are as follows:

[0045] Establish the BiLSTM model;

[0046] The spatial feature set obtained at different times is calculated using the forward LSTM and backward LSTM of the BiLSTM model to obtain the temporal feature set.

[0047] Furthermore, the spatial feature set obtained at different times is calculated using the forward LSTM and backward LSTM of the BiLSTM model to obtain the temporal feature set, including the following steps:

[0048] The forward LSTM of the BiLSTM model is used to calculate the spatial feature set obtained at different times to obtain the forward feature set;

[0049] The inverse feature set is obtained by using the inverse LSTM of the BiLSTM model to calculate the spatial feature set obtained at different times;

[0050] The attention mechanism is used to assign weights to the positive feature set and the negative feature set respectively, and the weighted positive feature set and the negative feature set are integrated to obtain the time feature set.

[0051] To address the aforementioned technical problems, this invention also provides an encrypted malicious stream identification device based on spatiotemporal features and an attention mechanism, the specific technical content of which is as follows:

[0052] An encrypted malicious stream identification device based on spatiotemporal features and attention mechanism includes a data processing module, a model building module, a model training module, and an identification module.

[0053] The data processing module is used to preprocess the raw data stream to obtain an initial data stream in a unified format; wherein, the raw data stream includes a normal encrypted data stream and an encrypted malicious data stream, and the raw data stream is a PCAP file stream;

[0054] The model building module is used to build a traffic trajectory topology graph based on the initial data stream; wherein, the nodes of the traffic trajectory topology graph represent the initial data stream, and the edges of the traffic trajectory topology graph represent the IP hosts shared by the nodes at both ends of the edges of the traffic trajectory topology graph;

[0055] The model building module is also used to extract key node features of the initial data stream from the traffic trajectory topology map through an attention mechanism to obtain a key node feature set;

[0056] The model building module is also used to build a node-level spatial attention feature map using the key node feature set.

[0057] The model building module is also used to extract spatial features of the key node feature set from the node-level spatial attention feature map using the SGC model, and obtain the spatial feature set.

[0058] The model building module is also used to extract the temporal features of the spatial feature set from the spatial feature set using a BiLSTM model, thereby obtaining a temporal feature set.

[0059] The model building module is also used to fuse the spatial feature set with the temporal feature set to obtain a spatial-temporal feature set;

[0060] The model building module is also used to assign weights to the spatial-temporal feature set through an attention mechanism to obtain model training feature sets with different weights.

[0061] The model training module is used to train a deep learning model using the model training feature set to obtain an encrypted malicious stream identification model.

[0062] The identification module is used to identify encrypted malicious data streams using the encrypted malicious stream identification model. Attached Figure Description

[0063] Figure 1 This is a flowchart of the encrypted malicious stream identification method based on spatiotemporal features and attention mechanism in an embodiment of the present invention;

[0064] Figure 2 This is a flowchart of the data preprocessing process in an embodiment of the present invention;

[0065] Figure 3 This is a schematic diagram of the flow trajectory topology in an embodiment of the present invention;

[0066] Figure 4 This is an execution flowchart of the node space attention machine in an embodiment of the present invention. Detailed Implementation

[0067] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0068] Example 1

[0069] like Figure 1 As shown, this embodiment provides a method for identifying encrypted malicious streams based on spatiotemporal features and attention mechanisms, including the following steps:

[0070] S1. Perform data preprocessing on the original data stream to obtain an initial data stream with a unified format; wherein, the original data stream includes a normal encrypted data stream and an encrypted malicious data stream, and the original data stream is a PCAP file stream.

[0071] Specifically, such as Figure 2 As shown, the original data stream is preprocessed to obtain an initial data stream with a uniform format, including the following steps:

[0072] S101. Obtain statistical information of all PCAP files in the original data stream to obtain a statistical information data stream; the specific steps are as follows:

[0073] Remove the header information of all PCAP files from the original data stream to obtain the initial statistical data stream; wherein each PCAP file in the initial statistical data stream contains only statistical information about the PCAP file;

[0074] Remove duplicate PCAP files and empty PCAP files from the initial statistical data stream to obtain an optimized statistical data stream.

[0075] The headers of all data in the optimized statistical data stream are removed or anonymized to obtain the statistical information data stream.

[0076] S102. Adjust the ratio of normally encrypted traffic information to maliciously encrypted traffic information in the statistical information data stream to 1:1 to obtain a balanced data stream;

[0077] S103. Perform data standardization processing on all data in the balanced data stream to obtain a standard data stream;

[0078] Specifically, since a byte can be converted into an integer in the range [0, 255], the fixed-byte stream sequence is converted into a vector. Then, the stream vector is normalized to the range [0, 1]. This improves the accuracy and convergence speed of the classification model training. Finally, the preprocessed byte data is labeled accordingly.

[0079] In the process of data standardization, assuming that there are m records in the dataset, Indicates the first The first record The values ​​of the features, where 1 ≤ If ≤m, then the standardized formula for the feature is as follows:

[0080] ij =

[0081] in, Represents the first in the dataset The average of the feature data, Indicates the first The standard deviation of each feature data ij This refers to the standard data stream.

[0082] S104. Tag all data in the standard data stream to obtain the initial data stream.

[0083] S2. Establish a traffic trajectory topology graph based on the initial data stream; wherein, the nodes of the traffic trajectory topology graph represent the initial data stream, and the edges of the traffic trajectory topology graph represent the IP hosts shared by the nodes at both ends of the edges of the traffic trajectory topology graph.

[0084] Network flow data consists of three parts: source address, destination address, and flow characteristics, including duration, transaction bytes, and packet size. Typically, graph-based methods use traffic trajectory topology graphs to classify network traffic. Flows with hosts sharing the same IP address may share a category, in which case network traffic classification becomes edge-based. To utilize our proposed SGC-LSA framework, we use a novel traffic trajectory topology graph to describe the topological relationships of traffic, such as... Figure 3 As shown on the right, in the traffic trajectory topology graph, a node represents network traffic, and an edge represents nodes at both ends sharing a single IP address. By constructing this new traffic trajectory topology graph, the task of detecting encrypted malicious traffic is transformed into the problem of detecting malicious nodes.

[0085] Establishing a traffic trajectory topology map based on the initial data stream includes the following steps:

[0086] An initial data flow network topology graph is established based on the initial data flow; wherein, the nodes of the initial data flow network topology graph represent the IP hosts, and the edges of the initial data flow network topology graph represent the initial data flow;

[0087] The initial data flow network topology is converted into the traffic trajectory topology.

[0088] Specifically, the traffic trajectory topology graph is represented as G(V, A); where V represents the set of nodes. , Belongs to the adjacency matrix, represented as , Let n be an n-order histogram; In the adjacency matrix middle, Represents a node With nodes The weight of the edges between them. Represents a node With nodes There are no edges connecting them, and the nodes are not connected. and nodes All belong to the node set ;

[0089] Define the degree matrix as The degree matrix is... Each component on the diagonal is equal to the adjacency matrix. Summing the rows, the degree matrix is: The formula for calculating each component on the diagonal is: ;

[0090] When each node When both have a d-dimensional eigenvector, it is denoted as Then the feature matrix is ​​formed by the feature vectors of n nodes. ;

[0091] Let there be n initial data streams, each of which has d-dimensional features, denoted as . , represents ; express The matrix, The node feature set of the initial data stream is represented by the adjacency matrix of all the initial data streams. When the flow Heliu When a host has a public IP address, it indicates a flow. and Highly correlated, then When the flow Heliu When there is no public IP host, it indicates a flow. With flow If unrelated, then If the neighbors of flow 3 include flows 1, 2, and 6, then we have .

[0092] S3. Using an attention mechanism, extract key node features of the initial data stream from the traffic trajectory topology map to obtain a key node feature set;

[0093] Specifically, the initial data stream with a public IP host is extracted from the traffic trajectory topology map through an attention mechanism;

[0094] The key node feature set is obtained by extracting the key node features of the initial data stream from the initial data stream with a public IP host.

[0095] S4. Build a node-level spatial attention feature map using the key node feature set.

[0096] The steps include: performing global average pooling on the key node feature set to obtain an initial feature vector;

[0097] The initial feature vector is compressed and mapped to obtain the mapped feature vector;

[0098] The dimension of the mapped feature vector is increased, and the sigmoid function is used to stimulate the dimension of the mapped feature vector to obtain an attention graph;

[0099] Weights are assigned to the attention graph using an attention mechanism to obtain the node-level spatial attention feature map.

[0100] By incorporating a node-level spatial attention mechanism, key node features in the new traffic trajectory topology are utilized, while simultaneously reducing the burden on the model. The initial data flow's node feature set... This serves as the input, and then outputs a new feature matrix for the subsequent SGC model. Using the characteristic matrix Denotes the mapped feature vector, where The matrix represents the node feature set corresponding to the initial data stream.

[0101] like Figure 4 The flowchart of the attention mechanism execution for the nodes shown illustrates that...

[0102] By using an attention mechanism, key node features of the initial data stream are extracted from the traffic trajectory topology graph to obtain a key node feature set. The specific steps are as follows:

[0103] The initial feature set is transformed into a key node feature set; wherein, the key node feature set is represented as follows: , , .

[0104] matrix Compressing into a 1×D vector, mapping a 1×D vector to a vector. ,vector The calculation formula is as follows:

[0105]

[0106] For vectors Dimensionality reduction is performed to obtain vectors. ;

[0107] Boosting Vector The dimension of the vector is determined, and the sigmoid function is used to activate the vector. The dimension of the attention graph is obtained. Among them, attention diagrams are obtained. The formula is as follows:

[0108]

[0109] Pay attention to the diagram The weight is used as the degree of attention;

[0110] Pay attention to the diagram The weights and the initial feature set Multiplying them yields the node-level spatial attention feature map; wherein, the key node feature set in the node-level spatial attention feature map... It is obtained from the following formula:

[0111]

[0112] This represents the data matrix corresponding to the key node feature set.

[0113] S5. Using the SGC model, extract the spatial features of the key node feature set from the node-level spatial attention feature map to obtain the spatial feature set;

[0114] The spatial feature set of key nodes is obtained by extracting spatial features from the node-level spatial attention feature map using the SGC model, including the following steps:

[0115] The SGC model is established; wherein the SGC model includes a linear classifier and multiple graph convolutional layers;

[0116] By utilizing multiple graph convolutional layers, node features in the node-level spatial attention feature map are learned to obtain node feature vectors;

[0117] The node feature vectors are input into the linear classifier for classification to obtain the spatial feature set.

[0118] In the SGC model, each graph convolutional layer uses variables. Indicate; set Indicates the first The input of the layer, let Indicates the first The output node of the layer is obtained = ;

[0119] The key node feature set The first graph convolutional layer of the SGC model is input; wherein, in the first... During the feature propagation process of the graph convolutional layer, the nodes Hidden feature representation ,node Hidden features The calculation formula is as follows:

[0120] +

[0121] Indicates the ( -1) Layer Nodes Hidden features, Represents a node The degree of the node, when the node and nodes When there is an edge between them, A value of 1 also indicates a node. Hidden features and nodes Related; the ( -1) Layer Nodes Hidden features With the ( -1) Layer Nodes Hidden features The correlation formula is as follows:

[0122]

[0123]

[0124] in, , The identity matrix, the matrix It is a matrix The degree matrix, S is the normalized matrix; Indicates by the ( -1) The matrix formed by the feature representations of all nodes in layer 1;

[0125] Using the weight matrix A linear transformation is performed on the hidden features of each graph convolutional layer in the SGC model; the linear transformation formula is as follows:

[0126]

[0127]

[0128]

[0129] = =

[0130] Where σ is the activation function, It is the first Layer weight matrix;

[0131] The spatial features of the key node feature set are extracted to obtain the spatial feature set; the formula for extracting the spatial features of the key node feature set is as follows:

[0132]

[0133] Among them, This represents the spatial feature set.

[0134] S6. Use the BiLSTM model to extract the temporal features of the spatial feature set to obtain the temporal feature set;

[0135] The temporal features of the spatial feature set are extracted from the spatial feature set using the BiLSTM model to obtain the temporal feature set. The specific steps are as follows:

[0136] Establish the BiLSTM model;

[0137] The spatial feature set obtained at different times is calculated using the forward LSTM and backward LSTM of the BiLSTM model to obtain the temporal feature set; the specific steps are as follows:

[0138] The forward LSTM of the BiLSTM model is used to calculate the spatial feature set obtained at different times to obtain the forward feature set;

[0139] The inverse feature set is obtained by using the inverse LSTM of the BiLSTM model to calculate the spatial feature set obtained at different times;

[0140] The attention mechanism is used to assign weights to the positive feature set and the negative feature set respectively, and the weighted positive feature set and the negative feature set are integrated to obtain the time feature set.

[0141] Specifically, the BiLSTM model is used to process the input sequence element values ​​at time t. The time feature set is obtained by calculating the forward LSTM and backward LSTM of the BiLSTM model; wherein, the sequence element values The spatial feature set input at time t .

[0142] Specifically, the BiLSTM model is used to process the input sequence element values ​​at time t. The time feature set is obtained by calculating the forward LSTM and backward LSTM of the BiLSTM model, including the following steps:

[0143] Input sequence element values ​​at time t Substituting the formulas for forward LSTM and backward LSTM of the BiLSTM model into the formulas respectively, we obtain the forward LSTM calculation results. and the results of inverse LSTM calculation ;

[0144] The result of the forward LSTM calculation and the inverse LSTM calculation results Weights are assigned to obtain the time feature set.

[0145] BiLSTM structure as follows Figure 4 As shown, the model includes an input layer, a forward hidden layer, a backward hidden layer, and an output layer. The forward LSTM extracts the forward features of the input deep flow feature sequence, while the backward LSTM extracts the backward features of the deep flow feature sequence from back to front. The output layer integrates the output data from both. At time step t, the BiLSTM model is used to process the element values ​​of the input sequence at the current time step. The calculations for forward and backward LSTM for feature extraction are shown in Table 1. In the equations, the symbols represent the input gate. Forgotten Gate Output gate The hidden state at the previous moment The hidden state at the current moment Input at the current time Temporary unit state The state of the cell at the previous moment . , , , These are the weight matrices for the memory cell state, forget gate, input gate, and output gate, respectively. , , , These represent the corresponding biases.

[0146] BiLSTM effectively utilizes the temporal features present in the data before and after network traffic to improve model training, enabling the model to comprehensively learn sequence features.

[0147] Table 1. Calculation formulas for forward LSTM and backward LSTM

[0148]

[0149] S7. The spatial feature set and the temporal feature set are fused to obtain a spatial-temporal feature set; the specific calculation formula for fusing the spatial feature set and the temporal feature set is as follows:

[0150]

[0151] , represents the weight matrix input to the hidden layer in the forward LSTM; This represents the weight matrix input to the hidden layer of the inverse LSTM; Indicates time Feature data in the spatial-temporal feature set.

[0152] S8. Through the attention mechanism, weights are assigned to the spatial-temporal feature set to obtain model training feature sets with different weights;

[0153] Specifically, the attention mechanism selects the most relevant information from a multitude of data, initially applied in image recognition and machine translation. Utilizing the attention mechanism allows for more accurate capture of the spatiotemporal features most relevant to the detection of encrypted malicious traffic, mitigating the negative impact of erroneous or redundant features. Different weights are assigned to traffic data features based on their importance, improving the classification performance of the traffic detection model. In this embodiment, the attention mechanism is used in the SGC-BiLSTM network to assign different weights to the module's output vector, making the model focus more on important features. The specific calculation formula for weighting the spatiotemporal feature set is as follows:

[0154]

[0155]

[0156]

[0157]

[0158] in , , , For trainable parameters, The feature vectors output from the BiLSTM layer are extracted and then processed by a nonlinear activation function to obtain the hidden representation. , Represents the context vector. Here, is the feature importance weighting coefficient, and s is the key feature obtained after importance weighting. For the output result, i.e. This represents the aforementioned set of spatial and temporal features.

[0159] S9. Train a deep learning model using the feature set of the model training method to obtain an encrypted malicious stream identification model; specifically, use the output results... The corresponding dataset is used to train a deep learning model to obtain an encrypted malicious stream identification model.

[0160] S10. Use the encrypted malicious stream identification model to identify encrypted malicious data streams.

[0161] This invention preprocesses raw pcap traffic files through traffic purification and imbalanced sample handling to avoid irrelevant features degrading model performance and efficiency, while also addressing the problem of imbalanced traffic samples. Secondly, by analyzing the attributes and temporal relationships between flows, a communication traffic interaction graph is constructed from the source and destination information of network traffic. Shallow and deep connection features of nodes are extracted, and behavioral characteristics of network host nodes during communication are explored, achieving a more reasonable and effective ability to extract flow sequence and topology features. Simultaneously, a spatial attention mechanism for nodes is incorporated to reduce the burden on the model. Finally, an SGC-LSA encrypted malicious traffic identification framework with an attention mechanism is designed. It utilizes SGC and BiLSTM to fully extract the spatiotemporal evolution features of the network from complex traffic data. Simultaneously, the attention mechanism is used to filter key classification features, improving the detection rate and identification efficiency of encrypted malicious traffic.

[0162] Example 2

[0163] Based on Embodiment 1, this embodiment provides an encrypted malicious stream identification device based on spatiotemporal features and attention mechanism, including a data processing module, a model building module, a model training module and an identification module;

[0164] The data processing module is used to preprocess the raw data stream to obtain an initial data stream in a unified format; wherein, the raw data stream includes a normal encrypted data stream and an encrypted malicious data stream, and the raw data stream is a PCAP file stream;

[0165] The model building module is used to build a traffic trajectory topology graph based on the initial data stream; wherein, the nodes of the traffic trajectory topology graph represent the initial data stream, and the edges of the traffic trajectory topology graph represent the IP hosts shared by the nodes at both ends of the edges of the traffic trajectory topology graph;

[0166] The model building module is also used to extract key node features of the initial data stream from the traffic trajectory topology map through an attention mechanism to obtain a key node feature set;

[0167] The model building module is also used to build a node-level spatial attention feature map using the key node feature set.

[0168] The model building module is also used to extract spatial features of the key node feature set from the node-level spatial attention feature map using the SGC model, and obtain the spatial feature set.

[0169] The model building module is also used to extract the temporal features of the spatial feature set from the spatial feature set using a BiLSTM model, thereby obtaining a temporal feature set.

[0170] The model building module is also used to fuse the spatial feature set with the temporal feature set to obtain a spatial-temporal feature set;

[0171] The model building module is also used to assign weights to the spatial-temporal feature set through an attention mechanism to obtain model training feature sets with different weights.

[0172] The model training module is used to train a deep learning model using the model training feature set to obtain an encrypted malicious stream identification model.

[0173] The identification module is used to identify encrypted malicious data streams using the encrypted malicious stream identification model.

[0174] Specifically, the data processing module, model building module, model training module, and recognition module are all computer program modules or computer systems capable of data processing and data calculation.

[0175] In this invention, SGC stands for Simple Graph Convolution, representing a graph convolutional neural network; BiLSTM stands for Bi-directional Long Short-Term Memory. PCAP represents a process characteristic analysis software package. This packet capture library provides a high-level interface for packet capture systems. All data packets on the network, even those sent to other hosts, can be captured through this mechanism. PCAP also supports saving captured data packets to local files and reading information from local files.

[0176] This embodiment modularizes the encrypted malicious stream identification method based on spatiotemporal features and attention mechanism using computer programs, making it easy to implement automatically through computer programs and improving data processing efficiency.

[0177] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the concept and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for identifying encrypted malicious streams based on spatiotemporal features and attention mechanisms, characterized in that, Includes the following steps: The raw data stream is preprocessed to obtain an initial data stream in a unified format; wherein, the raw data stream includes a normal encrypted data stream and an encrypted malicious data stream, and the raw data stream is a PCAP file stream; A traffic trajectory topology graph is established based on the initial data stream; wherein, the nodes of the traffic trajectory topology graph represent the initial data stream, and the edges of the traffic trajectory topology graph represent the IP hosts shared by the nodes at both ends of the edges of the traffic trajectory topology graph; By using an attention mechanism, key node features of the initial data stream are extracted from the traffic trajectory topology map to obtain a key node feature set. A node-level spatial attention feature map is constructed using the aforementioned key node feature set; The spatial features of the key node feature set are extracted from the node-level spatial attention feature map using the SGC model to obtain the spatial feature set; The temporal features of the spatial feature set are extracted from the spatial feature set using the BiLSTM model to obtain the temporal feature set; The spatial feature set and the temporal feature set are fused to obtain a spatial-temporal feature set; By using an attention mechanism, weights are assigned to the spatial-temporal feature set to obtain model training feature sets with different weights; A deep learning model is trained using the feature set of the model to obtain an encrypted malicious stream identification model. The encrypted malicious stream identification model is used to identify encrypted malicious data streams.

2. The encrypted malicious stream identification method based on spatiotemporal features and attention mechanism according to claim 1, characterized in that, The raw data stream is preprocessed to obtain an initial data stream with a uniform format, including the following steps: Obtain statistical information of all PCAP files in the original data stream to obtain a statistical information data stream; The normally encrypted traffic information and the maliciously encrypted traffic information in the statistical information data stream are adjusted to a 1:1 ratio to obtain a balanced data stream; All data in the balanced data stream are standardized to obtain a standard data stream. All data in the standard data stream is labeled to obtain the initial data stream.

3. The encrypted malicious stream identification method based on spatiotemporal features and attention mechanism according to claim 2, characterized in that, Obtaining statistical information from all PCAP files in the original data stream to obtain a statistical information data stream involves the following steps: Remove the header information of all PCAP files from the original data stream to obtain the initial statistical data stream; wherein each PCAP file in the initial statistical data stream contains only statistical information about the PCAP file; Duplicate PCAP files and empty PCAP files are removed from the initial statistical data stream to obtain an optimized statistical data stream; The headers of all data in the optimized statistical data stream are removed or anonymized to obtain the statistical information data stream.

4. The encrypted malicious stream identification method based on spatiotemporal features and attention mechanism according to claim 1, characterized in that, Establishing a traffic trajectory topology map based on the initial data stream includes the following steps: An initial data flow network topology graph is established based on the initial data flow; wherein, the nodes of the initial data flow network topology graph represent the IP hosts, and the edges of the initial data flow network topology graph represent the initial data flow; The initial data flow network topology is converted into the traffic trajectory topology.

5. The encrypted malicious stream identification method based on spatiotemporal features and attention mechanism according to claim 4, characterized in that, Using an attention mechanism, key node features of the initial data stream are extracted from the traffic trajectory topology graph to obtain a key node feature set, including the following steps: The initial data stream with a public IP host is extracted from the traffic trajectory topology using an attention mechanism. The key node feature set is obtained by extracting the key node features of the initial data stream from the initial data stream with a public IP host.

6. The encrypted malicious stream identification method based on spatiotemporal features and attention mechanism according to claim 5, characterized in that, The process of constructing a node-level spatial attention feature map using the key node feature set includes the following steps: The key node feature set is subjected to global average pooling to obtain an initial feature vector; The initial feature vector is compressed and mapped to obtain the mapped feature vector; The dimension of the mapped feature vector is increased, and the sigmoid function is used to stimulate the dimension of the mapped feature vector to obtain an attention graph; Weights are assigned to the attention graph using an attention mechanism to obtain the node-level spatial attention feature map.

7. The encrypted malicious stream identification method based on spatiotemporal features and attention mechanism according to claim 6, characterized in that, The spatial feature set of key nodes is obtained by extracting spatial features from the node-level spatial attention feature map using the SGC model, including the following steps: The SGC model is established; wherein the SGC model includes a linear classifier and multiple graph convolutional layers; By utilizing multiple graph convolutional layers, node features in the node-level spatial attention feature map are learned to obtain node feature vectors; The node feature vectors are input into the linear classifier for classification to obtain the spatial feature set.

8. The encrypted malicious stream identification method based on spatiotemporal features and attention mechanism according to claim 7, characterized in that, The temporal features of the spatial feature set are extracted from the spatial feature set using the BiLSTM model to obtain the temporal feature set. The specific steps are as follows: Establish the BiLSTM model; The spatial feature set obtained at different times is calculated using the forward LSTM and backward LSTM of the BiLSTM model to obtain the temporal feature set.

9. The encrypted malicious stream identification method based on spatiotemporal features and attention mechanism according to claim 8, characterized in that, The spatial feature set obtained at different times is calculated using the forward LSTM and backward LSTM of the BiLSTM model to obtain the temporal feature set, including the following steps: The forward LSTM of the BiLSTM model is used to calculate the spatial feature set obtained at different times to obtain the forward feature set; The inverse feature set is obtained by using the inverse LSTM of the BiLSTM model to calculate the spatial feature set obtained at different times; The attention mechanism is used to assign weights to the positive feature set and the negative feature set respectively, and the weighted positive feature set and the negative feature set are integrated to obtain the time feature set.

10. A device for identifying encrypted malicious streams based on spatiotemporal features and attention mechanisms, characterized in that: It includes a data processing module, a model building module, a model training module, and a recognition module; The data processing module is used to preprocess the raw data stream to obtain an initial data stream in a unified format; wherein, the raw data stream includes a normal encrypted data stream and an encrypted malicious data stream, and the raw data stream is a PCAP file stream; The model building module is used to build a traffic trajectory topology graph based on the initial data stream; wherein, the nodes of the traffic trajectory topology graph represent the initial data stream, and the edges of the traffic trajectory topology graph represent the IP hosts shared by the nodes at both ends of the edges of the traffic trajectory topology graph; The model building module is also used to extract key node features of the initial data stream from the traffic trajectory topology map through an attention mechanism to obtain a key node feature set; The model building module is also used to build a node-level spatial attention feature map using the key node feature set. The model building module is also used to extract spatial features of the key node feature set from the node-level spatial attention feature map using the SGC model, and obtain the spatial feature set. The model building module is also used to extract the temporal features of the spatial feature set from the spatial feature set using a BiLSTM model, thereby obtaining a temporal feature set. The model building module is also used to fuse the spatial feature set with the temporal feature set to obtain a spatial-temporal feature set; The model building module is also used to assign weights to the spatial-temporal feature set through an attention mechanism to obtain model training feature sets with different weights. The model training module is used to train a deep learning model using the model training feature set to obtain an encrypted malicious stream identification model. The identification module is used to identify encrypted malicious data streams using the encrypted malicious stream identification model.

Images