A multi-feature fusion intrusion detection method and system based on a graph neural network

Abstract

The application discloses a multi-feature fusion intrusion detection method based on a graph neural network, belongs to the technical field of cloud network anomaly detection, and comprises the following steps: recognizing network flow data; constructing a network interaction graph of the network flow data; acquiring topological information of the network flow data and edge feature information of the network interaction graph, and obtaining network interaction features of the network flow data based on the topological information and the edge feature information; and realizing network traffic classification and attack flow detection based on the network interaction features of the network flow data. The detection method provided in the application can simultaneously utilize the topological feature information in the network flow data and the edge feature information of the network interaction graph, can realize detection on a single attack flow, and can thus identify complex network attacks.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of cloud network anomaly detection, and particularly relates to a multi-feature fusion intrusion detection method and system based on a graph neural network. BACKGROUND

[0002] With the development and maturity of technology, the frequency and complexity of network attacks have significantly increased, and existing network attack detection technologies only consider traffic data records independently without considering the mutual relationship between them, resulting in more global traffic patterns, such as zombie network attacks, distributed port scanning or domain name system (DNS) amplification attacks, etc. The above-mentioned technologies are very weak in the face of complex network attacks. SUMMARY

[0003] The purpose of the embodiments of the application is to provide a multi-feature fusion intrusion detection method and system based on a graph neural network, which can solve the problem that existing cloud network anomaly detection technologies cannot detect complex network attacks.

[0004] In order to solve the above technical problems, the application is implemented as follows:

[0005] In a first aspect, the embodiments of the application provide a multi-feature fusion intrusion detection method based on a graph neural network, comprising:

[0006] S101: identifying network flow data;

[0007] S102: constructing a network interaction graph of the network flow data;

[0008] S103: obtaining topology information of the network flow data and edge feature information of the network interaction graph, and obtaining network interaction features of the network flow data based on the topology information and the edge feature information;

[0009] S104: realizing network traffic classification and attack flow detection based on the network interaction features of the network flow data. Further, S101 specifically comprises: the network flow data is identified through a communication endpoint, and the communication endpoint includes an IP address, an L4 port number and an L4 protocol.

[0010] Further, S102 comprises: the network flow data constructs the network interaction graph based on a GAT graph neural network.

[0011] Further, S102 further comprises: the network flow data includes flow endpoints and network traffic, and constructing the network interaction graph based on the network flow data comprises establishing a mapping relationship between the flow endpoints and nodes of the network interaction graph, and establishing a mapping relationship between the network traffic and edges of the network interaction graph.

[0012] Further, S103 comprises: the network flow data comprises annotated flow field information, the annotated flow field information at least comprising packet quantity, byte quantity and flow duration; and based on the annotated field information, obtaining topology feature information of the network flow data.

[0013] Further, S103 comprises: edge feature information of the network interaction graph is based on flow field identification, the flow field comprising: source IP address, source L4 port, destination IP address and destination L4 port, and the flow end point comprising source node and destination node; the first two-tuple comprising source IP address and source L4 port field, and the first two-tuple identifying the source node; the second two-tuple comprising destination IP address and destination L4 port, and the second two-tuple identifying the destination node.

[0014] Further, S103 specifically comprises: the network interaction graph comprises N layers of destination nodes, wherein N is an integer greater than or equal to 1, and the communication end point can simultaneously access multiple destination nodes; the number of destination nodes in one layer is at least two, and the destination nodes in the same layer are neighbor nodes; and the destination nodes in different layers are connected through edges of the network interaction graph.

[0015] Further, S103 specifically comprises:

[0016] S1031: the initial values of the features of the first layer neighbor nodes are the same, the number of the first layer neighbor nodes is j, and the initial value of the feature of the first layer neighbor nodes is h j ={1, 1, 1, …, 1}, wherein j is an integer greater than or equal to 1;

[0017] S1032: an attention layer is arranged between the neighbor nodes in the same layer, and the attention layer is used for scoring the importance of the neighbor nodes.

[0018] S1033: based on the topology feature information of the neighbor nodes of different communication end points, the different layer destination nodes having edge connection relationship are iteratively calculated, and the network interaction feature of the network flow data is obtained based on the Nth layer destination node.

[0019] Further, S104 specifically comprises:

[0020] S1041: the network interaction feature of the network flow data is transmitted to a full connection layer;

[0021] S1042: a SoftMax function is used to calculate the positive sample probability of the network flow data.

[0022] S1043: network traffic classification and attack flow detection are realized based on the positive sample probability of the network flow data.

[0023] In a second aspect, an embodiment of the present application provides a multi-feature fusion intrusion detection system based on a graph neural network, comprising:

[0024] a data set processing module configured to identify network flow data;

[0025] The data set processing module is further configured to construct a network interaction graph of the network flow data.

[0026] An interaction feature extraction module is configured to obtain topology information of the network flow data and edge feature information of the network interaction graph, and obtain network interaction features of the network flow data based on the topology information and the edge feature information.

[0027] A prediction classification module is configured to implement network traffic classification and attack flow detection based on the network interaction features of the network flow data.

[0028] In the embodiments of the present application, the network flow data is identified, the construction of the network interaction graph of the network flow data is completed, the topology information of the network flow data and the edge feature information of the network interaction graph are obtained, and the classification of the network traffic and the detection of the attack flow are realized based on the obtained topology information and edge feature information. The detection method provided in the present application can simultaneously utilize the topology feature information in the network flow data and the edge feature information of the network interaction graph, and can realize the detection of a single attack flow, thereby identifying complex network attacks. BRIEF DESCRIPTION OF DRAWINGS

[0029] Figure 1 is a flow diagram of a multi-feature fusion intrusion detection method based on a graph neural network provided by an embodiment of the present application;

[0030] Figure 2 is a schematic diagram of a network interaction graph construction method provided by an embodiment of the present application;

[0031] Figure 3 is a schematic diagram of annotated flow field information provided by an embodiment of the present application;

[0032] Figure 4 is a schematic diagram of the attention mechanism of GAT provided by an embodiment of the present application;

[0033] Figure 5 is a schematic diagram of a neighbor node topology of a communication endpoint provided by an embodiment of the present application;

[0034] Figure 6 is a framework diagram of a multi-feature fusion intrusion detection system based on a graph neural network provided by an embodiment of the present application.

[0035] The implementation of the object, functional characteristics and advantages of the present application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0036] In order to make the objects, technical solutions and advantages of the present application clearer, the following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0037] The following will describe in detail a multi-feature fusion intrusion detection method based on a graph neural network provided by the embodiments of the present application by specific embodiments and application scenarios in combination with the drawings.

[0038] Embodiment one

[0039] Referring to Figure 1 Fig. 1 shows a flowchart of a multi-feature fusion intrusion detection method based on a graph neural network provided by the embodiments of the present application.

[0040] The multi-feature fusion intrusion detection method based on a graph neural network provided by the embodiments of the present application comprises the following steps.

[0041] S101: identifying network flow data.

[0042] Network intrusion detection is usually performed on flow-based network data, and in a possible implementation, the network flow data can be identified by a communication endpoint.

[0043] Optionally, the communication endpoint comprises an IP address, an L4 port number and an L4 protocol. The type of the communication endpoint can be determined by those skilled in the art according to actual conditions, and the embodiments of the present application do not limit this.

[0044] S102: constructing a network interaction graph of the network flow data.

[0045] Optionally, in the embodiments of the present application, the network interaction graph of the network flow data is generated through related field information of the network flow data.

[0046] In a possible implementation, S102 comprises: the network flow data generates the network interaction graph based on GAT.

[0047] GAT is a graph neural network which can extend the related operation on two-dimensional data to the data with a graph structure, and the core idea is to aggregate the features of the own node and the neighbor nodes to update the vector representation of the node.

[0048] In a possible implementation, S102 further includes: the network interaction graph based on the GAT includes generating destination nodes of the network interaction graph and edge feature information between the destination nodes with a connection relationship. The network flow data includes flow endpoints and network traffic, and the network interaction graph is constructed based on the network flow data, which includes establishing a mapping relationship between the flow endpoints and the destination nodes of the network interaction graph, and establishing a mapping relationship between the network traffic and the edges of the network interaction graph.

[0049] Figure 2 FIG. 1 is a schematic diagram of a network interaction graph construction method provided by an embodiment of the present application. In an embodiment, a communication endpoint accesses destination nodes within a certain time, and the communication endpoint is denoted as SRC0. The node simultaneously accesses multiple destination nodes, denoted as DSTP (wherein P = 1, 2, … n). In the access process, the communication endpoint can access the destination node in one hop, or access the destination node in multiple hops. The destination nodes are connected through edges.

[0050] In the embodiment of the present application, the network interaction graph of the network flow data is generated based on the GAT graph neural network, which can realize iterative calculation of multiple layers of destination nodes, fully mine the features of the network flow data, and still has high resolution in front of complex network attacks.

[0051] In a possible implementation, S103 includes:

[0052] The topology feature information of the network flow data and the edge feature information of the network interaction graph are obtained, and the network interaction features of the network flow data are obtained based on the topology information and the edge feature information.

[0053] Optionally, the network flow data contains annotated flow field information, and the annotated flow field information at least includes a packet number, a byte number and a flow duration. The topology feature information of the network flow data is obtained based on the annotated field information.

[0054] Figure 3 FIG. 1 is a schematic diagram of annotated flow field information provided by an embodiment of the present application. The network flow data obtained by the communication endpoint contains annotated flow field information. The network data annotated flow field information can generate the topology structure of the destination nodes and the edges. The aggregated destination node features can be realized through different neighbor node topology structures.

[0055] In a possible implementation, S103 includes edge feature information of the network interaction graph is identified based on a flow field, and the flow field includes a source IP address, a source L4 port, a destination IP address, and a destination L4 port. Those skilled in the art can determine the flow field used to identify the edge feature information according to actual conditions, and the embodiments of the present application do not limit this. The flow end point includes a source node and a destination node; the first two-tuple includes the source IP address and the source L4 port field, and the first two-tuple identifies the source node; the second two-tuple includes the destination IP address and the destination L4 port, and the second two-tuple identifies the destination node.

[0056] Further, S103 specifically includes that the network interaction graph includes N layers of destination nodes, where N is an integer greater than or equal to 1, and a communication end point can access multiple destination nodes at the same time; the number of destination nodes in one layer is at least two, and the destination nodes in the same layer are neighbor nodes; and the destination nodes in different layers are connected through edges of the network interaction graph.

[0057] Further, S103 specifically includes:

[0058] S1031: The initial values of the features of the first layer of neighbor nodes are the same, the number of the first layer of neighbor nodes is j, and the initial value of the feature of the first layer of neighbor nodes is h j ={1, 1, 1, …, 1}, where j is an integer greater than or equal to 1;

[0059] S1032: An attention layer is arranged between the neighbor nodes in the same layer, and the attention layer is used to score the importance of the neighbor nodes.

[0060] Figure 4 FIG. 3 is a schematic diagram of an attention mechanism of GAT provided by the embodiments of the present application. The advantage of the attention mechanism in processing sequence tasks is that the scale of input data can be changed, and each part is assigned a weight through an attention score, so that the model only needs to care about important parts. GAT adds an attention layer in GNN, which can score the importance of each neighbor node and focus on assigning different weights, so that only the destination nodes with relatively large effects are focused on when aggregating the neighbor nodes, and some destination nodes with relatively small effects are ignored.

[0061] In the embodiments of the present application, GAT performs aggregation operation on neighbor nodes by using an attention mechanism, and adaptively assigns weights to different neighbor nodes, so as to improve the expression ability of the graph neural network model.

[0062] S1033: Based on the topology feature information of the neighbor nodes of different communication end points, the different layers of target nodes with edge connection relationship are iteratively calculated, and the network interaction features of the network flow data are obtained based on the Nth layer of destination nodes.

[0063] Optionally, in the embodiments of the present application, the core idea of GAT is used to update the vector representation of the destination node by aggregating the features of the destination node and the neighbor nodes. As shown in Figure 5 The topology features of different communication endpoint neighbor nodes are different, and through continuous iteration, the network interaction features of the network flow data are obtained according to the N-layer destination node. The difference in the network interaction features can complete the detection of abnormal IP.

[0064] In the embodiments of the present application, the topology feature difference of the neighbor nodes of different communication endpoints is used to realize the full mining of the network flow data features through the iterative calculation of the multi-layer destination node, and the network interaction features of the network flow data are accurately obtained, which has high resolution when dealing with complex network attack surfaces.

[0065] In a possible implementation, the network interaction features can be obtained based on the following calculation method:

[0066] Definition is the interaction vector of the jth communication endpoint in the network flow data set, which is used as the input feature vector of the GAT layer, where F represents the dimension of the input feature. The hidden feature F0 represents the dimension of the output feature. Each node applies the same shared linear transformation, as shown in the following formula:

[0067] z j = Wh j (1)

[0068] Then, the non-standardized attention score of the two paired destination nodes needs to be obtained, and the hidden features of the destination node and its neighbor nodes are connected, where || represents the merging operation. Then, a learnable weight vector Finally, the LeakyReLU activation function is applied, and the attention score can be calculated as shown in the following formula:

[0069]

[0070] This shows the importance of the destination node k to the destination node j. This makes it easy to compare the coefficients between different destination nodes. The SoftMax function is used to normalize them among all choices of j, and the calculation is as shown in the following formula:

[0071]

[0072] The neighbor node embeddings are aggregated together, and the feature vector of the jth destination node in the network flow data set will be updated according to the attention coefficient as shown in the following formula:

[0073] H j = a jk zj +∑ q∈N(i) α jq z q (4)

[0074] Eigenvector H j This refers to the network interaction features obtained after iterating through node j of the representative network flow dataset.

[0075] In one possible implementation, it also includes S104: Based on the network interaction characteristics of network flow data, network traffic classification and attack flow detection are achieved.

[0076] Furthermore, S104 specifically includes:

[0077] S1041: The network interaction characteristics of the network stream data are transmitted to the fully connected layer;

[0078] S1042: Calculate the positive sample probability of network stream data using the SoftMax function;

[0079] S1043: Network traffic classification and attack flow detection based on positive sample probability of network flow data.

[0080] The specific implementation of this step is as follows: first, the feature vector H... j After passing through a fully connected layer, the calculation is performed using the SoftMax function, as shown in the following formula:

[0081]

[0082] in This represents the probability of a positive sample. All parameters in the model are trained to minimize the cross-entropy loss function, as shown in the following equation:

[0083]

[0084] Where N represents the number of training samples, y j Indicates the true nature of the event.

[0085] Each node in the dataset has a true label y. j Corresponding to ∈{N,R} (N: non-attack, R: attack). Based on the above definition, the intrusion detection problem in this application embodiment can be summarized as follows: Given a set of destination nodes (IPs) D and a set of labels Y, the goal of intrusion detection is to find a classifier f(·), as shown in the following equation:

[0086] f(D)→Y(7)

[0087] Based on the above definition, the problem studied in this application embodiment is to perform a binary classification problem using a classifier f(·) based on the characteristics of events.

[0088] To evaluate the performance of the model used by the intrusion detection method provided in the embodiments of the present application, the accuracy (Accuracy), precision (Precision), recall (Recall) and F1 score (F1 score) are used to evaluate the performance of the model. In the calculation process, four intermediate parameters TP, TN, FP and FN need to be calculated. TP represents the number of test samples that are positive examples and are also predicted to be positive examples, TN represents the number of test samples that are negative examples and are also predicted to be negative examples, FP represents the number of test samples that are negative examples but are predicted to be positive examples, and FN represents the number of test samples that are positive examples but are predicted to be negative examples. The calculation formulas of the four indexes are as follows:

[0089]

[0090]

[0091]

[0092]

[0093] The calculation results of the four indexes in the embodiments of the present application are as follows:

[0094]

[0095] In order to further prove the effectiveness of the algorithm proposed in the embodiments of the present application, two kinds of relatively new algorithms Extra Tree Classifier and Ensemble are selected to compare the performance in F1-Score based on each data set, as shown in the following table:

[0096]

[0097] The calculation results show that the algorithm based on the detection method provided in the embodiments of the present application has better comprehensive performance compared with other algorithms.

[0098] In the embodiments of the present application, based on GAT, GCN and the like, a network interaction graph of network flow data is constructed, the edge features and the topology mode of communication endpoints are integrated in network intrusion detection, the stacked GAT layer is used to fully mine the network flow data, and finally the obtained interaction features are predicted to realize the ability of accurately identifying complex network attacks.

[0099] Embodiment two

[0100] Figure 6 It is a kind of multi-feature fusion intrusion detection system framework based on graph neural network provided by the embodiments of the present application. Based on Figure 6The application provides a multi-feature fusion intrusion detection system based on a graph neural network.

[0101] The detection system comprises:

[0102] The dataset processing module is configured to identify network flow data.

[0103] The dataset processing module is further configured to construct a network interaction graph of the network flow data.

[0104] The interaction feature extraction module is configured to obtain topological information of the network flow data and edge feature information of the network interaction graph, and obtain network interaction features of the network flow data based on the topological information and the edge feature information.

[0105] The prediction classification module is configured to realize network traffic classification and attack flow detection based on the network interaction features of the network flow data.

[0106] Further, the network flow data is identified by a communication endpoint, and the communication endpoint comprises an IP address, an L4 port number and an L4 protocol.

[0107] Further, the dataset processing module constructs the network interaction graph based on a GAT graph neural network.

[0108] Further, the network flow data comprises flow endpoints and network traffic, and the construction of the network interaction graph based on the network flow data comprises establishing a mapping relationship between the flow endpoints and nodes of the network interaction graph and establishing a mapping relationship between the network traffic and edges of the network interaction graph.

[0109] Further, the network flow data comprises annotated flow field information, and the annotated flow field information at least comprises a packet number, a byte number and a flow duration; and the topological feature information of the network flow data is obtained based on the annotated field information.

[0110] Further, the edge feature information of the network interaction graph is identified based on a flow field, and the flow field comprises a source IP address, a source L4 port, a destination IP address and a destination L4 port, and the flow endpoints comprise source nodes and destination nodes; a first two-tuple comprises a source IP address and a source L4 port field, and the first two-tuple identifies a source node; a second two-tuple comprises a destination IP address and a destination L4 port, and the second two-tuple identifies a destination node.

[0111] Further, the network interaction graph comprises N layers of destination nodes, wherein N is an integer greater than or equal to 1, and a plurality of destination nodes can be accessed by the communication endpoint at the same time; the number of destination nodes in one layer is at least two, and the destination nodes in the same layer are neighbor nodes; and the destination nodes in different layers are connected through edges of the network interaction graph.

[0112] Further, the interaction feature extraction module obtains the interaction features, which specifically comprises the following steps:

[0113] The characteristic initial values of the first layer neighbor nodes are the same, the number of the first layer neighbor nodes is j, and the characteristic initial value of the first layer neighbor nodes is h j ={1, 1, 1, …, 1}, wherein j is an integer greater than or equal to 1;

[0114] The attention layer is arranged between the neighbor nodes in the same layer, and the attention layer is used for scoring the importance of the neighbor nodes.

[0115] Based on the topology characteristic information of the neighbor nodes of different communication endpoints, the different layer target nodes with edge connection relationship are iteratively calculated, and the network interaction characteristics of the network flow data are obtained based on the Nth layer target node.

[0116] Further, the prediction classification module is specifically used for:

[0117] The network interaction characteristics of the network flow data are transmitted to the full connection layer;

[0118] The positive sample probability of the network flow data is calculated through the SoftMax function;

[0119] The network flow classification and attack flow detection are realized based on the positive sample probability of the network flow data.

[0120] In the embodiments of the application, based on GAT, GCN and the like, the network interaction graph of the network flow data is constructed, the edge feature and the topology mode of the communication endpoint are integrated in the network intrusion detection, the stacked GAT module is used to fully mine the network flow data, and finally the node interaction characteristics obtained through multiple iterations are sent to the classification module for the last prediction, so that the ability of recognizing complex network attacks can be realized.

[0121] The above are only embodiments of the present application and are not used to limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement and the like within the spirit and principle of the present application shall be included in the scope of claims of the present application.

Claims

1. A multi-feature fusion intrusion detection method based on a graph neural network, characterized in that, Comprising: S101: identifying network flow data; S102: constructing a network interaction graph of the network flow data; S103: obtaining topology feature information of the network flow data and edge feature information of the network interaction graph, and obtaining network interaction features of the network flow data based on the topology feature information and the edge feature information; S104: realizing network traffic classification and attack flow detection based on the network interaction features of the network flow data; Wherein, the S101 specifically comprises: the network flow data is identified through a communication endpoint, and the communication endpoint comprises an IP address, an L4 port number and an L4 protocol; Wherein, the S102 comprises: the network flow data is used to construct the network interaction graph based on a GAT graph neural network; Wherein, the S102 further comprises: the network flow data comprises flow endpoints and network traffic, and constructing the network interaction graph based on the network flow data comprises establishing a mapping relationship between the flow endpoints and destination nodes of the network interaction graph, and establishing a mapping relationship between the network traffic and edges of the network interaction graph.

2. The intrusion detection method of claim 1, wherein, The S103 comprises: the network flow data contains annotated flow field information, and the annotated flow field information at least comprises packet quantity, byte quantity and flow duration; based on the annotated flow field information, the topology feature information of the network flow data is obtained.

3. The intrusion detection method of claim 1, wherein, The S103 comprises: the edge feature information of the network interaction graph is identified based on a flow field, and the flow field comprises: a source IP address, a source L4 port, a destination IP address and a destination L4 port, and the flow endpoints comprise source nodes and destination nodes; a first two-tuple comprises the source IP address and the source L4 port field, and the first two-tuple identifies the source node; a second two-tuple comprises the destination IP address and the destination L4 port, and the second two-tuple identifies the destination node.

4. The intrusion detection method according to claim 2 or 3, characterized by, The S103 specifically comprises: The network interaction graph comprises N layers of destination nodes, wherein N is an integer greater than or equal to 1, and the communication endpoint can access multiple destination nodes at the same time; The number of destination nodes in one layer is at least two, and the destination nodes in the same layer are neighbor nodes; The destination nodes in different layers are connected through the edges of the network interaction graph.

5. The intrusion detection method of claim 4, wherein, The S103 specifically comprises: S1031: The initial values of the features of the first-layer neighbor nodes are the same, the number of the first-layer neighbor nodes is j, and the initial value of the feature of the first-layer neighbor nodes is wherein j is an integer greater than or equal to 1. S1032: an attention layer is arranged between the neighbor nodes in the same layer, and the attention layer is used to score the importance of the neighbor nodes; S1033: based on the topology feature information of the neighbor nodes of different communication endpoints, the destination nodes in different layers with edge connection relationship are iteratively calculated, and the network interaction features of the network flow data are obtained based on the destination nodes in the Nth layer.

6. The intrusion detection method of claim 5, wherein, The S104 specifically comprises: S1041: the network interaction features of the network flow data are transmitted to a fully connected layer; S1042: the positive sample probability of the network flow data is calculated through a SoftMax function; S1043: the network traffic classification and the attack flow detection are realized based on the positive sample probability of the network flow data.

7. A multi-feature fusion intrusion detection system based on a graph neural network, characterized in that, Comprising: A data set processing module for identifying network flow data; The data set processing module is further configured to construct a network interaction graph of the network flow data; An interaction feature extraction module is configured to acquire topology information of the network flow data and edge feature information of the network interaction graph, and obtain network interaction features of the network flow data based on the topology information and the edge feature information; A prediction classification module is configured to realize network traffic classification and attack flow detection based on the network interaction features of the network flow data; The network flow data is identified by a communication endpoint, and the communication endpoint includes an IP address, an L4 port number, and an L4 protocol. The network flow data is configured to construct the network interaction graph based on a GAT graph neural network. The network flow data includes flow endpoints and network traffic. The network interaction graph is constructed based on the network flow data, which includes establishing a mapping relationship between the flow endpoints and destination nodes of the network interaction graph, and establishing a mapping relationship between the network traffic and edges of the network interaction graph.

Images