Attack traffic classification method and device based on load level graph attention network

Abstract

The present invention discloses a method and apparatus for attack traffic classification based on a load-level graph attention network. The method comprises: parsing HTTP protocol requests in attack traffic, segmenting the parsed request payload into several subfields; constructing a traffic load graph; updating the initial encoding of nodes in the traffic load graph using a graph neural network model, and obtaining a classification result for the attack traffic based on the adjacency matrix of the updated result. The present invention implements web attack traffic detection.

Description

Technical Field

[0001] The present invention belongs to the field of network traffic management, relates to network traffic attack and defense countermeasure technology, and specifically relates to an attack traffic classification method and device based on a load level graph attention network. Background Art

[0002] With the rapid evolution of internet technology and the continuous improvement of computing power, the more efficient B / S architecture is becoming increasingly prevalent on the internet. More and more content providers are choosing to deploy their services on web pages, replacing existing applications. In addition to traditional web pages, various APIs and mini-programs have become new sources of traffic. While increasing the efficiency of web application development, these increased traffic entry points and call methods also introduce more complex security issues. Some malicious attackers, through research on web technologies, have developed various attack methods, such as cross-site scripting (XSS), Structured Query Language (SQL) injection, remote code execution, command execution, and directory traversal. By exploiting these attack methods and vulnerabilities in web services, web attackers can launch malicious attacks and infiltrate websites and web applications, stealing user data or disrupting system operations. In 2020, over 736 million web attacks were recorded against financial institutions alone. As one of the most common cyberattacks, web attacks are numerous, and most attacks result in serious privacy risks or financial losses.

[0003] To circumvent these malicious attacks, researchers in related fields have conducted extensive research. Many scholars have proposed technologies such as reverse proxy and SSL verification to strengthen the inherent security of web application services. However, these defensive measures rely heavily on the knowledge of web security experts, resulting in high costs and inability to adapt to changing attack vectors. Consequently, more researchers are focusing on detecting web attacks from the application layer's traffic payload. Traditional web application firewalls (WAFs) use regular expressions to match sensitive fields in traffic requests for misuse detection. Considering that the expressive power of a single regular expression is insufficient to match the increasingly complex forms of web attack payloads, researchers have begun to construct attack signature databases to detect known attacks. However, this approach requires constant updating of the attack signature database to adapt to new attack techniques and vulnerability types, and this lag poses a risk to system security.

[0004] With the rise of artificial intelligence (AI) technology, its application to web attack traffic detection has become a hot topic of research. These methods can be broadly categorized into two types: those based on manual feature extraction and end-to-end approaches. Manual feature extraction methods leverage expert experience to extract features from suspicious traffic requests, convert them into numerical features, and then feed them into traditional machine learning models to generate judgment results. Common methods include extracting statistical features from individual fields in the request header and n-gram frequency features. These methods rely on expert prior knowledge to convert traffic into numerical features, but suffer from issues such as an inability to fully and deeply capture traffic information, poor robustness to changes in traffic patterns, and a lengthy preprocessing phase. Furthermore, their detection performance is limited by the classification capabilities of traditional machine learning models. In recent years, with the widespread application of deep learning in web attack detection research, end-to-end approaches have demonstrated enhanced detection capabilities and generalization, eliminating the need to design new features to address new attack vectors. Researchers have begun treating request URI fields and other fields as string text, attempting to incorporate natural language processing (NLP) techniques to mine the semantic information within them. Models such as TextCNN, BiLSTM, and Transformer have been applied to this problem. However, these methods treat URIs or other fields in requests as unstructured text for feature extraction, while ignoring the non-sequential key-value pair dependencies inherent in web attack traffic requests. Summary of the Invention

[0005] The purpose of the present invention is to provide an attack traffic classification method and device based on a load level graph attention network, which realizes web attack traffic detection by forming a graph for each request.

[0006] The technical contents of the present invention include:

[0007] A method for attack traffic classification based on a load level graph attention network, the method comprising:

[0008] Parsing HTTP protocol requests in attack traffic, and dividing the parsed request payload into several subfields; wherein the request payload includes: request URI and request body;

[0009] Constructing a traffic load graph; wherein the nodes in the traffic load graph include: a node corresponding to the subfield and a common node representing the content of the request body; the edges in the traffic load graph are obtained based on the contextual adjacency and logical structure relationship of the subfield in the request payload; the initial code of the node corresponding to the subfield is obtained by numerically digitizing the subfield; the initial code of the common node is initially numerically represented by an all-zero vector; and the weight of the node is calculated based on the global word frequency information of the subfield and the frequency of occurrence of the subfield in the current payload;

[0010] A graph neural network model is used to update the initial coding of the nodes in the traffic load graph, and a classification result of the attack traffic is obtained based on the adjacency matrix of the updated result.

[0011] Furthermore, the HTTP protocol request in the attack traffic is parsed, and the parsed request payload is divided into several subfields, including:

[0012] Parsing HTTP protocol requests in attack traffic to obtain request payloads; wherein the request payloads include: request URIs and request contents;

[0013] Decoding the request payload; wherein the decoding method includes one or more of decoding the URL and HTML entity using URI decoding and HTML entity decoding methods, and decoding variables or function statements in the JS code using base64 decoding, unicode decoding, and String.fromCharCode();

[0014] Perform data generalization on the decoded payload;

[0015] The generalized payload is segmented into several subfields.

[0016] Furthermore, performing data generalization on the decoded payload includes:

[0017] Use regular expressions to identify the IP, domain name, and port number in the decoded payload.

[0018] Replace the values in IP, domain name, and port with specific abstract patterns;

[0019] Replace any remaining values in the decoded payload with 0.

[0020] Furthermore, the subfields include: a request URI sub-segment, a request key sub-segment, and a request value sub-segment.

[0021] Furthermore, the edges in the traffic load graph include:

[0022] The edge between the node corresponding to the request key sub-segment and the node corresponding to the request value sub-segment is constructed based on the logical structure relationship in the request payload;

[0023] and,

[0024] Edges between nodes corresponding to a sub-segment of the request URI and nodes corresponding to adjacent sub-segments of the sub-segment of the request URI, constructed based on contextual adjacency in the request payload;

[0025] and,

[0026] The edges between the nodes corresponding to the request value sub-segment and the nodes corresponding to the adjacent sub-segments of the request value sub-segment, built based on the contextual adjacency relationship in the request payload;

[0027] and,

[0028] The edge between the common node and the node corresponding to the last request URI sub-segment in the time dimension;

[0029] and,

[0030] Edges between common nodes and nodes corresponding to the requested key sub-fragment.

[0031] Furthermore, the initial code of the node is obtained by digitizing the subfield, including:

[0032] Pre-train the Glove model on the global traffic load corpus;

[0033] Each node is numerically encoded using a pre-trained Glove model to obtain an initial encoding of the node.

[0034] Furthermore, the weight of the node is calculated based on the global word frequency information of the subfield and the frequency of occurrence of the subfield in the current load, including:

[0035] Pre-trained TF-IDF model;

[0036] The subfield is input into a pre-trained TF-IDF model, so that the pre-trained TF-IDF model calculates the weight of the node in the graph to which it belongs according to the global word frequency information of the subfield and the frequency of occurrence in the current load.

[0037] An attack traffic classification device based on a load level graph attention network, the device comprising:

[0038] A pre-processing module is used to parse HTTP protocol requests in attack traffic and split the parsed request payload into a plurality of sub-fields; wherein the request payload includes: a request URI and a request body;

[0039] A graph construction module is configured to construct a traffic load graph; wherein the nodes in the traffic load graph include: a node corresponding to the subfield and a common node representing the content of the request body; the edges in the traffic load graph are obtained based on the contextual adjacency and logical structure relationship of the subfield in the request payload; the initial code of the node corresponding to the subfield is obtained by digitizing the subfield; the initial code of the common node is initially digitized as an all-zero vector; and the weight of the node is calculated based on the global word frequency information of the subfield and the frequency of occurrence of the subfield in the current payload;

[0040] The graph classification module is used to update the initial coding of the nodes in the traffic load graph using a graph neural network model, and obtain the classification result of the attack traffic based on the adjacency matrix of the updated result.

[0041] An electronic device, characterized in that it includes a memory and a processor, the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes instructions for executing any of the above methods.

[0042] A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, it implements any of the methods described above.

[0043] Compared with the prior art, the present invention has at least the following advantages:

[0044] 1. Using the method presented in this paper, the request payload of web attack traffic is treated as semi-structured text, and a request payload-level graph is constructed using local contextual and structural relationships. Furthermore, a detection framework based on a graph attention network model is proposed, which integrates global information to classify the request payload-level graph. Compared to graphs constructed using a global corpus, this method achieves good detection performance and generalization capabilities while using low memory resources.

[0045] 2. The present invention abstracts traffic requests into a graph structure that carries structural relationships, and uses a pre-trained word embedding model to digitize the nodes in the graph structure. At the same time, the weight of the node in the graph to which it belongs is calculated based on the global word frequency information and the frequency of occurrence in the current load.

[0046] 3. The present invention uses a graph attention network model to update nodes according to the edge relationships corresponding to the nodes in the graph structure, combines global information and local structured context information to improve the classification effect, and realizes the detection of attack traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 This is a flow chart of the attack traffic classification method based on load level graph attention network proposed in the present invention. DETAILED DESCRIPTION

[0048] The present invention is further described in detail below through specific embodiments and drawings.

[0049] The attack traffic classification method based on the load-level graph attention network provided by the present invention utilizes the designed load graph construction algorithm, input feature encoding algorithm, and graph classification algorithm based on the graph attention network to respectively segment and digitize each field in the request load of the web attack traffic, and uses the fields in the request load as nodes. The heterogeneous edges are constructed based on the field context relationship and structural relationship, and the structured traffic load is converted into a heterogeneous graph. The graph attention network model is used to learn and optimize the parameters of the graph structure, and the node encoding of the graph is updated from the word embedding initial vector. The global word frequency association statistical model is applied to obtain the node weight, and finally the encoding of the entire graph and its classification probability distribution are obtained to realize web attack traffic detection.

[0050] like Figure 1 As shown, the attack traffic classification method based on the load level graph attention network of the present invention includes the following steps.

[0051] Step 1: Parse the HTTP protocol request in the attack traffic and split the parsed request payload into several subfields.

[0052] For each attack type, the present invention collects the corresponding attack traffic, parses the HTTP protocol requests in the attack traffic, and obtains the request URI and request content by extracting the payload of the application layer protocol; for each request URI and request content in the attack traffic, URI decoding, HTML entity decoding, base64 decoding, etc. are used to attempt to decode them; for each decoded request URI and request content in the attack traffic, further data generalization is performed, and specific values are replaced by abstract patterns; for the preprocessed request payload, a set of constructed regular expressions are used to split the traffic request URI and request body into several sub-segments.

[0053] In a preferred embodiment of the present invention, in the process of collecting attack traffic, in order to characterize a more complete attack traffic detection model, it is necessary to collect traffic data generated by different types of web attacks as comprehensively as possible.

[0054] In a preferred embodiment of the present invention, the present invention uses fixed URI decoding and HTML entity decoding methods to decode URLs and HTML entities, and uses optional base64 decoding, Unicode decoding, and String.fromCharCode() to decode variables or function statements in JavaScript code. This simulates the process by which a server first decodes a request message after receiving it, preventing attackers from bypassing it by encoding malicious fields.

[0055] In a preferred embodiment of the present invention, regular expressions are used to identify IP addresses, domain names, and ports in the payload during data generalization. These fields with specific values are then generalized, replacing specific values with abstract patterns. After replacing these values, the remaining values in the payload are matched and replaced with 0. This prevents the graph neural network from learning specific fields and causing overfitting, while also improving feature learning efficiency.

[0056] In a preferred embodiment of the present invention, when segmenting the traffic request URI and request body into multiple sub-segments, for each decoded protocol layer request payload, the generalized payload is segmented to obtain segmented sub-segments. The following is a formal representation of payload data containing m+n+l sub-segments:

[0057] D={U1,...,U i ,...,U m ,K1,...,K j ,...,K n ,V1,...,V k ,...,V l}

[0058] Among them, U i Indicates a sub-fragment of the request URI, K j and V k Respectively represent the sub-fragments separated from the key and value in the request content.

[0059] Step 2: Construct a traffic load graph.

[0060] The present invention regards sub-segments as nodes of a graph, and for each graph node segmented from a request payload, connects the edges of the graph using its contextual adjacency and structural relationships to form a graph structure.

[0061] In a preferred embodiment of the present invention, in the traffic load graph, for each node in the traffic load graph, three types of heterogeneous edges are formed in the traffic load graph according to the adjacency relationship and structural relationship of its corresponding sub-segment in the original request load: the nodes of the first type of edge come from the key-value pairs in the request body, and are constructed by the logical structural relationship in the request body, that is, the two nodes of this type of edge are the key in the request body, and a sub-segment of the value corresponding to the key; the second type of edge is constructed using the adjacency relationship of the context, that is, the two nodes of each edge of this type are a sub-segment in the URI or request value, and its adjacent sub-segment; in order to ensure the connectivity of the graph, a "public" node B0 is set to abstractly represent the request body content, and is initially numerically represented by an all-0 vector. The third type of edge connects this node with the last sub-segment of the URI and each key of the request body.

[0062] The following is a formal representation of the node set and edge set of the load data graph:

[0063] N={U i , i∈[1,m]}+{K j , j∈[1,n]}+{V k , k∈[1,l]}+B0,

[0064] E={e jk ,j∈[1,n],k∈[1,l]}+{e ii′ ,i∈[1,m],i′∈[ip,i+p]}+{e kk′ ,k∈[1,l],k∈[kp,k+p]}+{e m0}+{e 0j , j∈[1,n]},

[0065] Where N is the set of nodes, E is the set of edges, and p represents the number of adjacent sub-segments considered during the second-type edge construction process. During graph construction, not only are the short-range dependencies of contextual relationships considered, but through the abstract node B0, potential long-range dependencies between key values can also be iterated in a short number of steps.

[0066] When encoding node features, first, use the pre-trained word embedding model to numerically encode each segmented request field, and use the keyword mining model based on word frequency to calculate the graph node weight. Specifically, for each field corresponding to a graph node, use the pre-trained Glove encoding to digitize it to obtain an initialized globally shared node representation matrix; for each field corresponding to a graph node, use the TF-IDF model based on the global word frequency information and the frequency of occurrence in the current load to calculate the weight of the node in the graph to which it belongs.

[0067] In a preferred embodiment of the present invention, the graph node initialization encoding technique described in the input feature encoding algorithm is as follows: for each node in the traffic load graph, a pre-trained word embedding model is used for numerical encoding. Specifically, a globally shared initialization node representation is constructed using the Glove model. Glove implements unsupervised word embedding representation based on global word frequency statistics, capturing the local contextual semantic connections of the sub-segments corresponding to the node while combining sub-segment co-occurrence information from the global traffic load corpus. The Glove model is pre-trained on the global traffic load corpus, and then the pre-trained Glove model is used to encode each node in the traffic load graph to obtain a globally shared encoding matrix for the initialized graph nodes.

[0068] The following is a formal representation of the initialization encoding of the load data graph node:

[0069] h n =Glove(n)

[0070] N emb ={h n , n∈N}

[0071] Among them, h n is the numerical code of the corresponding graph node n, N emb Represents the globally shared initialized encoding matrix.

[0072] When calculating the graph node weights, a global word frequency statistical model is used to numerically encode each node in the traffic load graph. Specifically, the TF-IDF model is used to calculate the importance coefficient of the node in the load graph to which it belongs, providing a basis for aggregating node feature representations to obtain graph feature representations.

[0073] Step 3: Use a graph neural network model to update the initial encoding of the nodes in the traffic load graph, and obtain the classification result of the attack traffic based on the adjacency matrix of the updated result.

[0074] Utilizing the constructed graph structure information and node encoding, the present invention uses a graph neural network model to update the graph node encoding, realize the feature representation and classification of the graph structure, and identify attack traffic. Specifically, for each node in the graph structure, the graph attention network model is used to update the node according to the edge relationship corresponding to the node in the graph structure; for each graph corresponding to the request load, the node weight is used to aggregate all the node representations in the graph to obtain the feature representation of the graph, which is used for classification tasks to realize the detection of attack traffic.

[0075] In a preferred embodiment of the present invention, the graph node feature extraction technology described in the graph classification algorithm based on the graph attention network is as follows: for each node encoding representation in the traffic load graph, a spatial domain graph neural network model that operates directly on the graph is used to update the node. Specifically, the graph attention network model is used to extend the information of the first-order neighbor nodes to the feature representation of the current node through the masked attention mechanism. The updated node representation contains the semantic correlation between adjacent nodes, so that sub-segments with large semantic gaps that may appear in different loads can obtain the current exact semantics by weighting the information of their neighbor nodes in a specific traffic load.

[0076] The following is a formal representation of node encoding updates:

[0077] a ij =a([Wh i ||Wh j ]),

[0078]

[0079]

[0080] where a ij The importance of node j to node i is represented by a linear mapping using a shared parameter W. The node features are first multiplied using the linear mapping method. The multiplied features of nodes j and i are then concatenated and mapped to the real space using a(·). The correlation coefficient is normalized using softmax to obtain the attention coefficient. Finally, based on the calculated attention coefficient, the weighted sum of the features of neighboring nodes is used as the final output feature of the node. Since the attention parameters a(·) and W are globally shared during the update process, this means that the final representation of the node also contains global information similar to other graph neural network models. In addition, to stabilize the learning process of self-attention, a multi-head extended attention is used to improve the effect of the model.

[0081] The following is a formal representation of node encoding updates using multi-head attention:

[0082]

[0083] Among them, W k is the linear mapping in the k-th attention calculation, The attention coefficient is calculated for the k-th attention head, and the output features of multiple attention heads are calculated separately and concatenated as the updated node features.

[0084] In a preferred embodiment of the present invention, the graph feature extraction and classification technology described in the graph classification algorithm based on the graph attention network is as follows: for each traffic load graph, the feature representation vector of the graph is calculated using the encoded representation of each node and its weight, and the feature extraction and classification neural network is trained by minimizing the cross entropy loss to achieve graph classification and further detect attack traffic.

[0085] The following is a formal representation of the classification probability calculation:

[0086]

[0087] Among them, β n The contribution weight of the node is determined by the TF-IDF algorithm. is a matrix that maps node features to the graph representation space, is the bias vector.

[0088] Experimental data.

[0089] The public datasets CSIC2010, FWAF, TBWIDD, and BDCI2022 are used as example datasets. The CSIC2010 dataset contains HTTP traffic data generated for e-commerce web applications, including 36,000 normal requests and 25,065 abnormal requests. Abnormal requests include common attack behaviors such as SQL injection, buffer overflow, and cross-site scripting. FWAF contains 48,126 malicious requests and a large number of normal requests. TBWIDD collects data from network honeypots and uses a predefined whitelist to filter normal behavior, capturing in-the-wild web attack traffic. It contains 13,048 normal requests and 9,249 abnormal requests. The BDCI2022 dataset is derived from public data from the CCF Big Data & Computing Intelligence Contest 2022 Web Attack Detection and Classification Identification competition. The traffic data is categorized into six different labels, including normal requests, SQL injection, XSS, directory traversal, command execution, and remote code execution, totaling approximately 35,000 items.

[0090] 1) First, four experiments are conducted on four different data sets to obtain the application layer protocol request URI and request content in the traffic data;

[0091] 2) performing preprocessing operations such as decoding and generalization on the request URI and request content obtained in 1) to obtain a preprocessed request payload;

[0092] 3) For the preprocessed request payload obtained in 2), construct a regular expression to segment it into nodes of a graph, and connect the edges of the graph based on adjacency and structural relationships;

[0093] 4) For the nodes of the graph obtained in 3), use the pre-trained word embedding model to calculate the globally shared initial graph node encoding matrix, and use the global word frequency statistics model to calculate its importance coefficient in the corresponding graph;

[0094] 5) For the node encoding matrix of the graph obtained in 4), use the graph attention network to update its node encoding;

[0095] 6) For the updated node encoding representation obtained in 4) and the node importance coefficient obtained in 3), the node feature vectors in the load graph are aggregated through weighted summation to obtain the graph feature representation vector for the sample to be tested. The perceptron network combined with the Softmax function is used to calculate the probability that the sample to be tested is attack traffic.

[0096] To compare the results of the proposed method with other methods, the baseline methods (HMMPAYL, TextCNN, GraphXSS) were trained on the training set of the CSIC2010 dataset and tested on the divided test set, and the classification accuracy (%), missed detection rate (%) and false alarm rate (%) were shown.

[0097] Table 1. Accuracy, missed detection rate, and false alarm rate of this method compared with other methods for attack traffic detection on the CSIC2010 dataset

[0098] Evaluation indicators Method of the present invention HMMPAYL TextCNN GraphXSS Accuracy 99.38 92.63 98.48 97.21 False negative rate 0.32 8.27 0.38 3.31 False alarm rate 0.61 7.97 2.74 2.93

[0099] To compare the results of the proposed method with other methods, the baseline methods (HMMPAYL, TextCNN, GraphXSS) were trained on the training set of the FWAF dataset and tested on the divided test set, and the classification accuracy (%), missed detection rate (%) and false alarm rate (%) were displayed.

[0100] Table 2. Accuracy, missed detection rate, and false positive rate of this method compared with other methods in attack traffic detection on the FWAF dataset

[0101] Evaluation indicators Method of the present invention HMMPAYL TextCNN GraphXSS Accuracy 98.69 91.26 96.67 97.44 False negative rate 1.17 7.51 4.66 2.61 False alarm rate 1.31 8.32 3.79 2.59

[0102] To compare the results of the proposed method with other methods, the baseline methods (HMMPAYL, TextCNN, GraphXSS) were trained on the training set of the TBWIDD dataset and tested on the divided test set, and the classification accuracy (%), missed detection rate (%) and false alarm rate (%) were shown.

[0103] Table 3. Accuracy, missed detection rate, and false alarm rate of this method compared with other methods for attack traffic detection on the TBWIDD dataset

[0104]

[0105]

[0106] To compare the results of the proposed method with other methods, the baseline methods (HMMPAYL, TextCNN, GraphXSS) were trained on the training set of the BDCI2022 dataset and tested on the divided test set, and the classification accuracy (%), missed detection rate (%) and false alarm rate (%) were displayed.

[0107] Table 4. Accuracy, missed detection rate, and false alarm rate of this method compared with other methods for attack traffic detection on the BDCI2022 dataset

[0108] Evaluation indicators Method of the present invention HMMPAYL TextCNN GraphXSS Accuracy 97.47 85.32 94.57 97.26 False negative rate 6.01 23.81 6.80 5.56 False alarm rate 2.53 28.93 7.16 9.52

[0109] The results of the proposed method are compared with those of other methods. The method is trained on the training set of the CSIC2010, FWAF, TBWIDD, and BDCI2022 datasets, and tested on the partitioned test set. The memory usage and the average size of the edge set of the constructed graph are also shown.

[0110] Table 5. Memory usage and average edge size of the constructed graph for attack traffic detection using this method compared to other methods on the CSIC2010, FWAF, TBWIDD, and BDCI2022 datasets

[0111] Dataset Method of the present invention GraphXSS CSIC2010 285MB(92) 84370MB(2305449) FWAF 119MB(68) 76905MB(1619610) TBWIDD 28MB(55) 4660MB(69551) BDCI2022 291MB(213) 23964MB(2140072)

[0112] According to the results in Table 1, Table 2, Table 3, Table 4, and Table 5, the superiority of the attack traffic classification method based on the load level graph attention network proposed by the method of the present invention is reflected.

[0113] In summary, for each application layer traffic instance to be determined, the present invention extracts the traffic load URI and request body, decodes and generalizes them, and then splits them into a field list. The traffic load graph is constructed using the adjacency and structural relationships of the fields, and the attack traffic detection is achieved using a graph neural network. The present invention first collects web attack traffic instances of different attack types, extracts and preprocesses the request load for each instance; splits the preprocessed request load as the nodes of the graph, and constructs the graph using the contextual relationship and structural relationship of the fields; uses a pre-trained word embedding model to initialize the nodes of the coding graph, and uses word frequency statistics to calculate the graph node weights; uses the constructed graph structure relationship and node encoding, and uses a graph neural network model to update the graph node encoding to achieve feature representation and classification of the graph structure, thereby achieving attack traffic detection.

[0114] Based on the same inventive concept, another embodiment of the present invention provides an attack traffic classification device based on a load level graph attention network, which includes:

[0115] A pre-processing module is used to parse HTTP protocol requests in attack traffic and split the parsed request payload into a plurality of sub-fields; wherein the request payload includes: a request URI and a request body;

[0116] A graph construction module is configured to construct a traffic load graph; wherein the nodes in the traffic load graph include: a node corresponding to the subfield and a common node representing the content of the request body; the edges in the traffic load graph are obtained based on the contextual adjacency and logical structure relationship of the subfield in the request payload; the initial code of the node corresponding to the subfield is obtained by digitizing the subfield; the initial code of the common node is initially digitized as an all-zero vector; and the weight of the node is calculated based on the global word frequency information of the subfield and the frequency of occurrence of the subfield in the current payload;

[0117] The graph classification module is used to update the initial coding of the nodes in the traffic load graph using a graph neural network model, and obtain the classification result of the attack traffic based on the adjacency matrix of the updated result.

[0118] The specific implementation process of each module refers to the above description of the method of the present invention.

[0119] Based on the same inventive concept, another embodiment of the present invention provides an electronic device (computer, server, smart phone, etc.), which includes a memory and a processor, the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes instructions for executing each step in the method of the present invention.

[0120] Based on the same inventive concept, another embodiment of the present invention provides a computer-readable storage medium (such as ROM / RAM, disk, CD), which stores a computer program. When the computer program is executed by a computer, it implements the various steps of the method of the present invention.

[0121] The above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit the same. Those skilled in the art may modify or make equivalent substitutions for the technical solutions of the present invention without departing from the spirit and scope of the present invention. The scope of protection of the present invention shall be based on the claims.

Claims

1. A load level graph attention network-based attack traffic classification method, characterized by: The method comprises: Parsing HTTP protocol requests in attack traffic, and dividing the parsed request payload into several subfields; wherein the request payload includes: request URI and request body; Constructing a traffic load graph; wherein the nodes in the traffic load graph include: a node corresponding to the subfield and a common node representing the content of the request body; the edges in the traffic load graph are obtained based on the contextual adjacency and logical structure relationship of the subfield in the request payload; the initial code of the node corresponding to the subfield is obtained by numerically digitizing the subfield; the initial code of the common node is initially numerically represented by an all-zero vector; and the weight of the node is calculated based on the global word frequency information of the subfield and the frequency of occurrence of the subfield in the current payload; A graph neural network model is used to update the initial coding of the nodes in the traffic load graph, and a classification result of the attack traffic is obtained based on the adjacency matrix of the updated result.

2. The method according to claim 1, wherein The HTTP protocol request in the attack traffic is parsed and the parsed request payload is divided into several subfields, including: Parsing HTTP protocol requests in attack traffic to obtain request payloads; wherein the request payloads include: request URIs and request contents; Decoding the request payload; wherein the decoding method includes one or more of decoding the URL and HTML entity using URI decoding and HTML entity decoding methods, and decoding variables or function statements in the JS code using base64 decoding, unicode decoding, and String.fromCharCode(); Perform data generalization on the decoded payload; The generalized payload is segmented into several subfields.

3. The method according to claim 2, wherein The data generalization of the decoded payload includes: Use regular expressions to identify the IP, domain name, and port number in the decoded payload. Replace the values in IP, domain name, and port with specific abstract patterns; Replace any remaining values in the decoded payload with 0.

4. The method according to claim 1, wherein The subfields include: a request URI sub-segment, a request key sub-segment, and a request value sub-segment.

5. The method according to claim 4, wherein The edges in the traffic load graph include: The edge between the node corresponding to the request key sub-segment and the node corresponding to the request value sub-segment is constructed based on the logical structure relationship in the request payload; and, Edges between nodes corresponding to a sub-segment of the request URI and nodes corresponding to adjacent sub-segments of the sub-segment of the request URI, constructed based on contextual adjacency in the request payload; and, The edges between the nodes corresponding to the request value sub-segment and the nodes corresponding to the adjacent sub-segments of the request value sub-segment, built based on the contextual adjacency relationship in the request payload; and, The edge between the common node and the node corresponding to the last request URI sub-segment in the time dimension; and, Edges between common nodes and nodes corresponding to the requested key sub-fragment.

6. The method according to claim 1, wherein The initial encoding of the node is obtained by digitizing the subfield, including: Pre-train the Glove model on the global traffic load corpus; Each node is numerically encoded using a pre-trained Glove model to obtain an initial encoding of the node.

7. The method according to claim 1, wherein The weight of the node is calculated based on the global word frequency information of the subfield and the frequency of occurrence of the subfield in the current load, including: Pre-trained TF-IDF model; The subfield is input into a pre-trained TF-IDF model, so that the pre-trained TF-IDF model calculates the weight of the node in the graph to which it belongs according to the global word frequency information of the subfield and the frequency of occurrence in the current load.

8. An attack traffic classification device based on load level graph attention network, characterized in that: The device comprises: A pre-processing module is used to parse HTTP protocol requests in attack traffic and split the parsed request payload into a plurality of sub-fields; wherein the request payload includes: a request URI and a request body; A graph construction module is configured to construct a traffic load graph; wherein the nodes in the traffic load graph include: a node corresponding to the subfield and a common node representing the content of the request body; the edges in the traffic load graph are obtained based on the contextual adjacency and logical structure relationship of the subfield in the request payload; the initial code of the node corresponding to the subfield is obtained by digitizing the subfield; the initial code of the common node is initially digitized as an all-zero vector; and the weight of the node is calculated based on the global word frequency information of the subfield and the frequency of occurrence of the subfield in the current payload; The graph classification module is used to update the initial coding of the nodes in the traffic load graph using a graph neural network model, and obtain the classification result of the attack traffic based on the adjacency matrix of the updated result.

9. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program comprises instructions for executing the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the method according to any one of claims 1 to 7 is implemented.

Images