A network intrusion detection method and device based on graph neural network

Abstract

The present invention discloses a network intrusion detection method and device based on graph neural network. The present invention pulls network traffic data by monitoring the mirror port of the switch, collects network host information and network traffic information, and uses the collected information to construct host and traffic features. Subsequently, the graph neural network is used to simultaneously aggregate edge information and node information to learn the pattern structure of traffic and nodes. The regularly collected data is input into the trained graph neural network model, and by measuring the offset between the traffic to be detected and the normal traffic pattern, abnormal traffic information is detected, and the abnormal traffic information is stored and pushed to operation and maintenance personnel. The present invention also constructs a device for implementing this method, provides an efficient data collection method, selects key feature information, and simultaneously takes into account the features of both node and edge dimensions, which can effectively identify constantly changing abnormal traffic and issue alarms in a timely manner.

Description

Technical Field

[0001] The present invention relates to the field of network intrusion detection, and in particular to a network intrusion detection method and device based on graph neural network. Background Art

[0002] Over the past few years, with the increasing popularity and evolution of internet technology, cyberattacks have become increasingly common. Most enterprises have their own portal websites for distributing information, providing services to users, and promoting external communications. To achieve these functions, portal websites need to call on internal or external services, forming a service network connecting different applications within the enterprise. In this context, preventing cyberattacks has become extremely important. Cyber attackers can steal network information, resulting in user privacy leaks, or use botnets to launch DDoS attacks, reducing the availability of critical equipment. Furthermore, some large enterprises or state-owned enterprises store highly sensitive information. If an attack results in information leakage or abnormal status, it would not only cause severe economic losses but also pose a significant threat to national security and public safety. Network intrusion detection, which monitors network traffic, is a key tool for detecting and preventing cyberattacks. Its purpose is to monitor network traffic and provide alerts of anomalies, enabling system operators to take timely action.

[0003] Most network intrusion detection methods employ signature-based approaches, which compare predefined attack signatures with monitored network traffic. This approach can achieve relatively high accuracy when prior knowledge of network attacks is available. However, network attack technologies are constantly evolving, and signature-based approaches are far from ideal when new and changing attack types emerge. There are also some machine learning-based network intrusion detection methods that detect abnormal network traffic by evaluating the deviation of monitored traffic from normal network traffic. However, current methods have the following shortcomings:

[0004] 1) Often only individual traffic records are considered, without considering the implicit mutual influence of these flows due to the network topology.

[0005] 2) They often only consider the characteristics of traffic without considering the characteristics of nodes (hosts) in the network, which makes the modeling of abnormal situations too one-sided. Summary of the Invention

[0006] In view of the defects that existing methods cannot effectively apply changing and novel attack types, and the modeling is too one-sided and cannot simultaneously consider device host information and network structure information, the present invention proposes a network intrusion detection method based on graph neural network.

[0007] This method selects reasonable traffic features and host features, which correspond to the edge and node features in the graph respectively, and proposes a novel graph neural network method to fully combine the (host) information of the nodes in the graph and the (traffic) information of the edges in the graph. It fully considers the impact of the network structure on the traffic characteristics and can effectively deal with complex and changeable abnormal network traffic. Therefore, it can effectively locate abnormal traffic and realize network intrusion detection.

[0008] The present invention is implemented by the following technical means: According to the first aspect of the specification, a network intrusion detection method based on a graph neural network is provided, and the method comprises the following steps:

[0009] S1. Redirect data. Configure port mirroring on the switch that needs to monitor the network, and redirect the network traffic data that needs to be monitored in a non-invasive manner.

[0010] S2. Collect data by monitoring the mirror port configured on the switch in the data redirection step and collecting all TCP traffic packets.

[0011] S3, data preprocessing, obtains TCP packet-related information from each TCP packet and records the information of each host, including static data information and dynamic real-time data information updated in real time. This information will be stored in a locally deployed database;

[0012] S4. Construct network graph structure data, treating each host number and port number pair as a node. The feature vector of each node contains multiple categories of features, including static host software configuration features, host hardware configuration features, and dynamic host software and hardware statistics features, host network traffic related statistics features, and host abnormality statistics features.

[0013] An edge is uniquely identified by two nodes, and the edge also has multiple categories of features, including static network topology features, dynamic TCP packet statistics features, and abnormal historical situation statistics features;

[0014] S5. Model construction and model training: Model construction involves using a graph neural network to treat network traffic information as edges in the graph, combining it with graph node features to ultimately construct a high-level node representation. This high-level node representation is then used to reconstruct the original edge information and calculate the reconstruction error between the reconstructed information and the original data. In the model training phase, the optimization goal is to minimize the reconstruction error loss function, ultimately training the network parameters.

[0015] S6. Online attack inference prediction. The specific steps are as follows: After model training is completed, data is continuously collected. At fixed time intervals, the traffic information appearing in the network within the interval is extracted as network graph structure data. The error loss function value of each edge is calculated using the reconstruction error method in S5. The larger the loss function value, the greater the deviation between the detected traffic and normal traffic, which means that it is more likely to be abnormal traffic.

[0016] S7. Abnormal warning: Abnormal traffic information is stored and pushed to operation and maintenance personnel so that abnormalities can be discovered and located in time and subsequent data analysis can be carried out.

[0017] Furthermore, the collected TCP traffic packets are stored in a distributed file system in PCAP format using POSIX.

[0018] Furthermore, in the data preprocessing: the collected TCP traffic packets are processed in a periodic micro-batch manner.

[0019] Furthermore, in the data preprocessing, when storing data, the collected information is cached in the memory.

[0020] Furthermore, the features of multiple categories of each node in the network graph structure data are constructed including:

[0021] Static host software configuration features, including: host operating system version, host security software version, and host network port driver version;

[0022] Static host hardware configuration features, including: host network port bandwidth, host CPU parameters, host memory size, host memory read / write speed, and host disk read / write speed;

[0023] Dynamic host software and hardware statistics, including: host startup time, host CPU usage, host memory usage, host disk usage, number of threads currently running on the host, and number of errors that occurred on the host in the past period;

[0024] Dynamic host network traffic statistics, including: the host's current network bandwidth usage, the number of TCP packets sent and received by the host in the past period, the total number of bytes of TCP packets sent and received by the host in the past period, and the number of abnormal network packets received by the host in the past period;

[0025] Dynamic host anomaly statistics, including: the number of historical abnormal traffic associated with the host, the time since the last abnormal traffic associated with the host, and the weighted average of the anomaly levels of the abnormal traffic associated with the host;

[0026] Furthermore, the features of multiple categories of each edge in the network graph structure data are constructed including:

[0027] Static network configuration and topology features, including the number of edges associated with the two end nodes and the bandwidth between the two corresponding nodes;

[0028] Dynamic TCP packet statistics features, including: the number of TCP packets sent between two nodes in the past period, the total number of bytes of TCP packets sent between two nodes in the past period, the current network delay of the edge, and information about the IP addresses contained in the edge;

[0029] Dynamic anomaly history statistical features include: the number of abnormal traffic flows that have occurred on this edge in the past, the time since the last abnormal traffic flow occurred on this edge, the weighted average of the abnormal traffic levels that have occurred on this edge, and information about the IP addresses that have been associated with abnormal traffic on this edge over the past period of time.

[0030] Furthermore, in the network graph structure data constructed in S4, specific values of features are obtained after feature screening based on the collected information.

[0031] Furthermore, the data sent to the operation and maintenance personnel in the S7 abnormal warning includes specific details of the abnormal traffic, node information associated with the abnormal traffic, abnormal traffic abnormality level divided according to the abnormality score, and the time when the abnormality occurred.

[0032] According to a second aspect of the specification, a network intrusion detection device based on a graph neural network is provided, the device comprising: a data collection server, a storage module, a model training server, and a monitoring screen;

[0033] The data collection server is used for data collection and data preprocessing in S2-S3. It collects all TCP traffic packets by monitoring the mirror port configured on the switch in the data redirection step; obtains information associated with each TCP packet and records information about each host, including static data information and dynamic real-time data information updated in real time. This information will be stored in a locally deployed database.

[0034] The storage module is used to store edge node information in the network;

[0035] The model training server is used for model construction and training in S5-S6, as well as for online attack inference and prediction. Specifically, it utilizes a graph neural network, treating network traffic information as edges in the graph and combining it with graph node features to ultimately construct a high-level node representation. The high-level node representation is then used to reconstruct the original edge information and calculate the reconstruction error between the reconstructed information and the original data. The optimization goal of model training is to minimize the reconstruction error loss function, ultimately training the network parameters.

[0036] After model training is completed, data is continuously collected. At fixed time intervals, the traffic information that occurs in the network within the interval is extracted as network graph structure data. The error loss function value of each edge is calculated using the reconstruction error method in S5. The larger the loss function value, the greater the deviation between the detected traffic and normal traffic, which means that it is more likely to be abnormal traffic.

[0037] The monitoring screen is used for abnormal warning in S7, and pushes the data of the operation and maintenance personnel, including the specific details of the abnormal traffic, the node information associated with the abnormal traffic, the abnormal level of the abnormal traffic divided according to the abnormal score, and the time when the abnormality occurred, to the operation and maintenance personnel, so as to timely discover the abnormality, locate the abnormality and conduct subsequent data analysis.

[0038] Furthermore, in step S6, after the model training is completed, the data collection server will continue to collect data, extract the traffic information that appeared in the network within the past time interval as graph structure information at fixed time intervals, and then record the graph structure and initiate a prediction request.

[0039] The beneficial effects of the present invention are as follows: the present invention provides a complete process of data collection, model training, model prediction, and abnormal warning, with a clear deployment structure and obvious effects. The present invention uses the deviation of abnormal traffic from normal patterns to detect anomalies, which solves the defect that traditional signature-based intrusion detection cannot effectively deal with new and changing abnormal traffic that has not been pre-entered. In addition, the present invention fully considers the information of both node and edge dimensions, and the modeling of traffic is more complete and the effect is more prominent. Finally, the present invention provides a real-time monitoring screen, which outputs abnormal traffic information and related main information in a timely manner, which can help system operation and maintenance personnel quickly locate anomalies and take effective measures in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A diagram of the deployment architecture of a network intrusion detection device based on a graph neural network provided by an embodiment of the present invention;

[0041] Figure 2 A flowchart of an implementation method for network intrusion detection based on a graph neural network provided by an embodiment of the present invention;

[0042] Figure 3 A schematic diagram of model feature aggregation in a network intrusion detection method based on a graph neural network provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0043] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0044] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0045] The present invention provides a network intrusion detection method based on graph neural network. Figure 2 As shown, it basically includes the following steps:

[0046] S1 first locates the data and configures port mirroring for the switch that needs to monitor the network. It also configures the monitoring mode to mirror all traffic, sets the source port to the port number to be monitored, and sets the mirror port to the port number connected to the data collection server. It then non-invasively redirects the network traffic data that needs to be monitored.

[0047] After S2 data location is completed, data needs to be collected. The data collection server runs a separate process, listens to the switch mirror port configured in step (1), collects all TCP packets, and stores them in the distributed file system in PCAP file format in POSIX mode.

[0048] S3 performs data preprocessing on the collected raw data. The main implementation method is as follows: the data collection server runs a separate process, which periodically scans the files stored by the data collection process in micro-batches to obtain static information and dynamic real-time information. A variety of information such as the destination host IP address, source host IP address, destination host port number, source host port number, TCP packet size, etc. are obtained from each TCP packet. The data collection server records information about each host, including static information such as the host's operating system version, communication software version, and security software version, as well as the number of TCP packets and total number of bytes sent by the host over a period of time, as well as dynamic and real-time updated information such as abnormal traffic that the host has been associated with, the host's current CPU usage, and network bandwidth usage. The data collection server stores this information in a locally deployed database and uses a distributed memory database to maintain a cache of the relevant status of each host.

[0049] S4 builds network graph structure data: The data collection server treats each (host number, port number) pair as a node, and the feature vector of each node contains multiple dimensions:

[0050] Static host software configuration features include: host operating system version, host security software version, host network port driver version, etc. The corresponding information will be input into the locally deployed knowledge graph platform, and the output score will be used as the feature value.

[0051] Static host hardware configuration features include information such as host network port bandwidth, host CPU parameters, host memory size, host memory read / write speed, and host disk read / write speed. Similar to software configuration features, feature values are generated.

[0052] Dynamic host software and hardware statistics, including: host startup time, host CPU usage, host memory usage, host disk usage, number of threads currently running on the host, number of errors that occurred on the host in the past period, and other information.

[0053] Dynamic host network traffic statistics, including: the host's current network bandwidth usage, the number of TCP packets sent and received by the host in the past period, the total number of bytes of TCP packets sent and received by the host in the past period, and the number of abnormal network packets received by the host in the past period.

[0054] Dynamic host anomaly statistics, including: the number of historical abnormal traffic associated with the host, the time since the last abnormal traffic associated with the host, and the weighted average of the abnormality levels of the abnormal traffic associated with the host.

[0055] In addition to node information, edge information is also extracted. An edge is uniquely identified by two nodes. For example, a pair of (host number 1, port number 80, host number 2, port number 8080) identifies an edge. Edges also have multi-dimensional characteristics:

[0056] Static network configuration and topology features, including the number of edges associated with the two end nodes, the bandwidth between the two corresponding nodes, and other information.

[0057] Dynamic TCP packet statistics include: the number of TCP packets sent between two nodes in the past period of time, the total number of bytes of TCP packets sent between two nodes in the past period of time, the current network delay of the edge, and information about the IP addresses contained in the edge.

[0058] Dynamic anomaly history statistical features include: the number of abnormal traffic flows that have occurred on this edge in the past, the time since the last abnormal traffic flow occurred on this edge, the weighted average of the abnormal traffic levels that have occurred on this edge, and information about IP addresses that have been associated with abnormal traffic on this edge over a period of time.

[0059] Finally, to facilitate training and representation, all N nodes are represented as integers ranging from 0 to N-1. A memory-mapped data structure is used to maintain the mapping from (host name, port number) pairs to the integer representing the node. The edge representation is also simplified accordingly. All generated graph information is stored in a locally deployed distributed in-memory database for efficiency and fault tolerance.

[0060] The main means of S5 model construction and model training are as follows: All host information extracted in step (4) constitutes the node set of the graph structure and the corresponding original features, and all traffic information extracted constitutes the edge set of the graph structure and the corresponding original features. The association between each traffic information and the host information at both ends corresponds to the association relationship between the edge and the two nodes in the graph structure. i Represents node i, whose characteristics are Where F represents the dimension of node features, and its construction method is as described in step (4). i,j Represents the edge connecting node i and node j, which is characterized by Where E represents the edge feature dimension, and its construction method is as described in step (4). The node set and edge set are represented as ε. Represents the node embedding of the lth layer, 0≤l≤L, L represents the total number of graph neural network layers, and the node embedding of the 0th layer is the original node feature. Represent two learnable matrix parameters, where the meanings of F and E have been given above.

[0061] like Figure 3 As shown, the scores between neighbor nodes are weighted and aggregated to form the representation of the next layer of nodes;

[0062] In this embodiment, in order to get The calculation method is as follows:

[0063] For node v i All neighbor nodes (nodes connected by edges) v j , calculate v j With v i The relevant scores are:

[0064]

[0065] Among them, β i,j =LeakyReLU(a T [((W v h i )⊙(tanh(W e k i,j )))||((W v h i )⊙(tanh(W e k i,j ))), exp represents the exponential function, LeakyReLU represents the LeakyReLU function, tanh represents the hyperbolic tangent function, ⊙ represents the Hadamard product, a is a learnable parameter vector, T represents the transpose, || represents the concatenation operation, ∑ represents the summation operator, represents the set of neighbor nodes of node i. Finally, The calculation method is:

[0066]

[0067] Here, σ represents the sigmoid function.

[0068] The above process is repeated for multiple rounds to obtain the learned features of each node in the final output. The final error loss function is:

[0069]

[0070] Among them, W z is a trainable parameter, ∥ represents a concatenation operation, T represents a transposition, and σ represents a sigmoid function. This method uses the Adam optimizer, with a learning rate set to 0.001, a dropout probability set to 0.32, and L2 regularization. The model training server pulls the network data generated in step (4) from a locally deployed distributed memory database and trains it using the method described above to obtain a trained model.

[0071] The main implementation methods of S6 attack online inference prediction are as follows: after the model is trained, the data collection server will continue to collect data and extract the traffic information that appeared in the network in the past 10 minutes as graph structure information at intervals of 10 minutes. The specific steps are shown in steps (S1), (S2), (S3), and (S4) of this method. The graph structure is then stored in a locally deployed distributed memory database, and a prediction request is initiated to the model training server.

[0072] After receiving the prediction request, the model training server pulls the network data to be predicted from the memory database, calculates the error loss function value of each edge in the manner described in step (5), and calculates the 90% quantile, which is recorded as Anomaly_threshold, that is, the abnormal score. Subsequently, all traffic with error loss function values higher than Anomaly_threshold is identified as abnormal traffic.

[0073] S7 Anomaly Warning: To better analyze anomaly information, the abnormal traffic description, the identifiers of the two nodes associated with the abnormal traffic, and a timestamp are immediately stored in a locally built OLTP database for subsequent data analysis. Furthermore, to provide timely warnings, this method also pushes abnormal data to the monitoring screen, including key information such as the specific details of the abnormal traffic, the node information associated with the abnormal traffic, the abnormality level of the abnormal traffic (classified according to the anomaly score calculated above), and the time when the anomaly occurred.

[0074] As shown in Table 1, the test results on the local dataset provided by the embodiment of the present invention are as follows: for data during the 618 event, the F1 score is 1.00, and the accuracy is 99.96%; for daily data sampled in May, the F1 score is 0.98, and the accuracy is 96.48%; for daily data sampled in June, the F1 score is 0.99, and the accuracy is 98.03%; for data during the National Day, the F1 score is 0.95, and the accuracy is 92.91%. It can be seen that the method provided by the present invention can achieve an accuracy of more than 90% in the enterprise traffic dataset, and the F1 score can reach more than 0.9.

[0075] Table 1

[0076] Dataset F1 score value Accuracy Data during the 618 event 1.00 99.96％ Daily data sampling in May 0.98 96.48％ Daily data sampling in June 0.99 98.03％ Data during National Day 0.95 92.91％

[0077] like Figure 1 As shown: An embodiment of the present invention provides a network intrusion detection device based on a graph neural network, the device comprising: a data collection server, a storage module, a model training server and a monitoring screen;

[0078] The data collection server is used for data collection and data preprocessing in S2-S3. It collects all TCP traffic packets by monitoring the mirror port configured on the switch in the data redirection step; obtains information associated with each TCP packet and records information about each host, including static data information and dynamic real-time data information updated in real time. This information will be stored in a locally deployed database.

[0079] The storage module is used to store edge node information in the network;

[0080] The model training server is used for model construction and training in S5-S6, as well as for online attack inference and prediction. Specifically, it utilizes a graph neural network, treating network traffic information as edges in the graph and combining it with graph node features to ultimately construct a high-level node representation. The high-level node representation is then used to reconstruct the original edge information and calculate the reconstruction error between the reconstructed information and the original data. The optimization goal of model training is to minimize the reconstruction error loss function, ultimately training the network parameters.

[0081] After model training is completed, data is continuously collected. At fixed time intervals, the traffic information that occurs in the network within the interval is extracted as network graph structure data. The error loss function value of each edge is calculated using the reconstruction error method in S5. The larger the loss function value, the greater the deviation between the detected traffic and normal traffic, which means that it is more likely to be abnormal traffic.

[0082] The monitoring screen is used for abnormal warning in S7, and pushes the data of the operation and maintenance personnel, including the specific details of the abnormal traffic, the node information associated with the abnormal traffic, the abnormal level of the abnormal traffic divided according to the abnormal score, and the time when the abnormality occurred, to the operation and maintenance personnel, so as to timely discover the abnormality, locate the abnormality and conduct subsequent data analysis.

[0083] In step S6, after the model training is completed, the data collection server will continue to collect data, extract the traffic information that appeared in the network within the past time interval as graph structure information at fixed time intervals, and then write down the graph structure and initiate a prediction request.

[0084] The above embodiments are used to illustrate the present invention rather than to limit the present invention. Any modifications and changes made to the present invention within the spirit of the present invention and the protection scope of the claims shall fall within the protection scope of the present invention.

Claims

1. A network intrusion detection method based on graph neural network, characterized in that: The method comprises the following steps: S1. Redirect data: Configure port mirroring on the switch that needs to monitor the network, and redirect the network traffic data that needs to be monitored in a non-invasive manner; S2, collect data: collect all TCP traffic packets by monitoring the mirror port configured on the switch in S1; S3, Data Preprocessing: Obtain information associated with each TCP traffic packet and record information about each host, including static data and real-time dynamic data. This information will be stored in a locally deployed database. S4. Constructing network graph structure data: Each host number and port number pair is treated as a node. The feature vector of each node contains multiple categories of features, including static host software configuration features, host hardware configuration features, and dynamic host software and hardware statistics features, host network traffic related statistics features, and host abnormality statistics features. An edge is uniquely identified by two nodes, and the edge also has multiple categories of features, including static network topology features, dynamic TCP traffic packet statistics features, and abnormal historical situation statistics features; S5. Model construction and training: Model construction involves using a graph neural network to treat network traffic information as edges in the graph, combining it with graph node features to ultimately construct a high-level node representation. This high-level node representation is then used to reconstruct the original edge information and calculate the reconstruction error between the reconstructed information and the original data. The optimization goal of model training is to minimize the reconstruction error loss function and ultimately train the network parameters; S6. Online attack inference prediction: After model training is complete, data is continuously collected. At fixed time intervals, traffic information occurring within the interval is extracted as network graph structure data. The error loss function value of each edge is calculated using the reconstruction error method in S5. The larger the loss function value, the greater the deviation between the detected traffic and normal traffic, which means that it is more likely to be abnormal traffic. S7. Abnormal warning: Abnormal traffic information is stored and pushed to operation and maintenance personnel so that abnormalities can be discovered and located in time and subsequent data analysis can be carried out.

2. The network intrusion detection method based on graph neural network according to claim 1 is characterized in that: The collected TCP traffic packets are stored in the distributed file system in PCAP format using POSIX.

3. The network intrusion detection method based on graph neural network according to claim 1 is characterized in that: In the data preprocessing, the collected TCP traffic packets are processed in a periodic micro-batch manner.

4. The network intrusion detection method based on graph neural network according to claim 1 is characterized in that: In the data preprocessing, when storing data, the collected information is cached in the memory.

5. The network intrusion detection method based on graph neural network according to claim 1 is characterized in that: In the process of constructing the network graph structure data, the multiple categories of features of each node include: Static host software configuration features, including: host operating system version, host security software version, and host network port driver version; Static host hardware configuration features, including: host network port bandwidth, host CPU parameters, host memory size, host memory read / write speed, and host disk read / write speed; Dynamic host software and hardware statistics, including: host startup time, host CPU usage, host memory usage, host disk usage, number of threads currently running on the host, and number of errors that occurred on the host in the past period; Dynamic host network traffic statistics, including: the host's current network bandwidth usage, the number of TCP packets sent and received by the host in the past period, the total number of bytes of TCP packets sent and received by the host in the past period, and the number of abnormal network packets received by the host in the past period; Dynamic host anomaly statistics, including the number of historical abnormal traffic associated with the host, the time since the last abnormal traffic associated with the host, and the weighted average of the anomaly levels of the abnormal traffic associated with the host.

6. The network intrusion detection method based on graph neural network according to claim 1 is characterized in that: In the process of constructing the network graph structure data, the multiple categories of features of each edge include: Static network configuration and topology features, including the number of edges associated with the two end nodes and the bandwidth between the two corresponding nodes; Dynamic TCP packet statistics features, including: the number of TCP packets sent between two nodes in the past period, the total number of bytes of TCP packets sent between two nodes in the past period, the current network delay of the edge, and information about the IP addresses contained in the edge; Dynamic anomaly history statistical features include: the number of abnormal traffic flows that have occurred on this edge in the past, the time since the last abnormal traffic flow occurred on this edge, the weighted average of the abnormal traffic levels that have occurred on this edge, and information about the IP addresses that have been associated with abnormal traffic on this edge over the past period of time.

7. The network intrusion detection method based on graph neural network according to claim 1 is characterized in that: In the process of constructing the network graph structure data, the specific value of the feature is obtained after feature screening based on the collected information.

8. The network intrusion detection method based on graph neural network according to claim 1 is characterized in that: In the abnormal warning, the data sent to the operation and maintenance personnel includes the specific details of the abnormal traffic, the node information associated with the abnormal traffic, the 90% quantile of the reconstruction error loss function is selected as the abnormal score, and the abnormal traffic abnormality level and the time when the abnormality occurred are divided according to the abnormal score.

9. A network intrusion detection device based on graph neural network for implementing the method according to any one of claims 1 to 8, characterized in that: The device includes: a data collection server, a storage module, a model training server and a monitoring screen; The data collection server is used for data collection and data preprocessing in S2-S3. It collects all TCP traffic packets by monitoring the mirror port configured on the switch in the data redirection step; obtains information associated with each TCP packet and records information about each host, including static data information and dynamic real-time data information updated in real time. This information will be stored in a locally deployed database. The storage module is used to store edge node information in the network; The model training server is used for model construction and training in S5-S6, as well as for online attack inference and prediction. Specifically, it utilizes a graph neural network, treating network traffic information as edges in the graph and combining it with graph node features to ultimately construct a high-level node representation. The high-level node representation is then used to reconstruct the original edge information and calculate the reconstruction error between the reconstructed information and the original data. The optimization goal of model training is to minimize the reconstruction error loss function, ultimately training the network parameters. After model training is completed, data is continuously collected. At fixed time intervals, the traffic information that occurs in the network within the interval is extracted as network graph structure data. The error loss function value of each edge is calculated using the reconstruction error method in S5. The larger the loss function value, the greater the deviation between the detected traffic and normal traffic, which means that it is more likely to be abnormal traffic. The monitoring screen is used for abnormal warning in S7, and pushes the data of the operation and maintenance personnel, including the specific details of the abnormal traffic, the node information associated with the abnormal traffic, the abnormal level of the abnormal traffic divided according to the abnormal score, and the time when the abnormality occurred, to the operation and maintenance personnel, so as to timely discover the abnormality, locate the abnormality and conduct subsequent data analysis.

10. The network intrusion detection device based on graph neural network according to claim 9, characterized in that: In step S6, after the model training is completed, the data collection server will continue to collect data, extract the traffic information that appeared in the network within the past time interval as graph structure information at fixed time intervals, and then write down the graph structure and initiate a prediction request.

Images