Threat node perception method based on deep learning graph neural network theory

Abstract

The application discloses a threat node perception method based on a deep learning graph neural network theory to improve network security performance, detection efficiency and accuracy of a threat node, comprising the following steps: performing data cleaning on original data traffic, generating information association rules by using an Apriori algorithm, and then performing feature conversion and data preprocessing to obtain preprocessed data; based on the association rules, constructing a public opinion key node topology structure of relationships between nodes involved; converting a time domain signal into a frequency domain by using Fourier transform of a graph, solving eigenvalues by using a Laplacian matrix, and constructing a spectral domain graph model of public opinion information; defining a structure of a graph neural network, and using the preprocessed data and the public opinion key node topology structure to train the spectral domain graph model; then using a cross-validation set to detect whether a prediction result of the spectral domain graph model is correct, and calculating accuracy, precision, recall and F1 score indicators of the spectral domain graph model.

Description

TECHNICAL FIELD

[0001] The application relates to the field of network security technology, and particularly relates to a threat node perception method based on a deep learning graph neural network theory. BACKGROUND

[0002] Traditional threat node perception methods based on rules and signatures usually require a large amount of manual feature engineering and manual parameter tuning, and have limitations in processing complex network threats. Therefore, intelligent improvement is needed. Traditional methods are difficult to model complex nonlinear relationships, and their accuracy and robustness may be limited. In recent years, artificial intelligence technology has been widely applied in the field of network security. For example, deep learning algorithms are used for intrusion detection, anomaly detection, etc. to improve their accuracy and robustness. The algorithms have the advantage of automatic feature extraction and can effectively process large-scale and complex data, thereby improving the efficiency and usability of the model. SUMMARY

[0003] The application aims to provide a threat node perception method based on a deep learning graph neural network theory to improve the network security performance, detection efficiency and accuracy of threat nodes.

[0004] The application is implemented by the following technical scheme: a threat node perception method based on a deep learning graph neural network theory, comprising the following steps:

[0005] 1) performing data cleaning on original data traffic, generating information association rules by using an Apriori algorithm, and then performing feature conversion and data preprocessing steps to obtain a node feature matrix and preprocessed data for spectral domain graph model training;

[0006] 2) after step 1), combining the node feature matrix and the adjacency matrix of the network session information node to construct a topology structure of the public opinion key node;

[0007] 3) converting the time domain signal of the topology structure of step 2) into a frequency domain by using Fourier transform of a graph, solving the eigenvalues by using a Laplacian matrix, constructing a spectral domain graph model of public opinion information, defining the structure of a graph neural network, and using the preprocessed data and the topology structure of the public opinion key node to train the spectral domain graph model;

[0008] 4) after completing the training of the spectral domain graph model, testing and evaluating the spectral domain graph model: using a cross-validation set in the preprocessed data to detect whether the prediction result of the spectral domain graph model is correct, and calculating the accuracy, precision, recall and F1 score indicators of the spectral domain graph model.

[0009] Further, in order to better realize the threat node perception method based on the deep learning graph neural network theory, the following settings are particularly adopted: the step 1) comprises the following steps:

[0010] 1.1) De-duplication, since the same network packet can be sent multiple times, it is necessary to de-duplicate the original data to ensure the accuracy and efficiency of subsequent analysis;

[0011] 1.2) Eliminate abnormal data such as packets with a length of 0, packets with the same source IP and destination IP, and packets with abnormal lengths;

[0012] 1.3) Through Apriori data format conversion, the original data is converted into a format with network sessions as units: each network session (session) is regarded as a "transaction", and each transaction is composed of network data;

[0013] 1.4) Support degree calculation for the list of transactions: first, calculate the support degree of each item set in the list of transactions, that is, the frequency of the item set appearing in all transactions; the formula for support degree calculation is as follows: support degree = number of occurrences of item set / total number of transactions;

[0014] 1.5) Support degree screening: according to the set support degree threshold, screen out item sets with a support degree greater than or equal to the threshold, and define such item sets as frequent item sets, wherein each item set of the frequent item set represents a node set containing several nodes;

[0015] 1.6) Generate association rules: for each frequent item set, generate association rules according to the set confidence threshold; wherein the confidence of the association rule is defined as the frequency of the consequent of the rule appearing in the antecedent of the rule, and the calculation formula is as follows: confidence = support degree of rule / support degree of antecedent;

[0016] 1.7) Confidence screening: according to the set confidence threshold, screen out association rules with a confidence greater than or equal to the threshold;

[0017] 1.8) Output frequent item sets and association rules: output frequent item sets and association rules that meet the support degree and confidence threshold requirements;

[0018] 1.9) Transform the association rules obtained in step 1.8) into a node feature matrix: represent each item set of the frequent item set as a node set, which contains several nodes, and represent the connection strength between each node and the association rule as an element in the node feature matrix; in the node feature matrix, each row corresponds to a node, and each column corresponds to an association rule; if there is a connection between a certain node and a certain association rule, the corresponding node feature matrix element value is a non-zero real number, otherwise it is zero;

[0019] 1.10) Calculate the connection strength: after transforming the association rules into the node feature matrix, use the support in the association rules to represent the connection strength between the node and the association rule;

[0020] 1.11) Normalize the node feature matrix using the "max-min normalization" method to eliminate the difference between the feature values and ensure that different features have the same scale and range;

[0021] 1.12) Use the K-fold cross-validation method to divide the data set after step 1.11) into K equal-sized cross-validation subsets for subsequent model training and testing.

[0022] Further, in order to better realize the threat node perception method based on the deep learning graph neural network theory of the present application, the following setting mode is particularly adopted: the step 2) comprises the following steps:

[0023] 2.1) Obtain the connection between nodes by analyzing the network session information in the original data to construct an adjacency matrix, each network session is regarded as a node, and the communication between different sessions is regarded as the connection between nodes, and the adjacency matrix is constructed according to the interaction between sessions to describe the connection between nodes;

[0024] 2.2) Splice the adjacency matrix constructed in step 2.1) and the normalized node feature matrix in step 1.11) to form a new matrix; the new matrix is taken as a graph data structure, and this new graph data structure is a representation form of the public opinion key node topology structure, wherein the nodes of the graph data structure correspond to the rows in the new matrix, and the edges between the nodes correspond to the non-zero elements in the adjacency matrix; in this way, a graph data structure centered on the public opinion key node is obtained, wherein each node includes its feature information and the connection with other nodes.

[0025] Further, in order to better realize the threat node perception method based on the deep learning graph neural network theory of the present application, the following setting mode is particularly adopted: the step 3) comprises the following steps:

[0026] 3.1) Transforming time-domain signals to frequency domain by applying Fourier transform of graph to the adjacency matrix, the resulting spectral representation captures important features of the graph topology and is used for further analysis, specifically: the Fourier transform of a graph G with adjacency matrix A is defined as where φ j is the jth eigenvector of the graph, φ1, φ2,..., φ n are eigenvectors of the graph, λ are the corresponding eigenvalues, denotes the representation of the signal f in the frequency domain; the inverse Fourier transform formula is as follows where φ * j is the complex conjugate of φ j ;

[0027] 3.2) Solving the eigenvalues and eigenvectors of the graph using the Laplacian matrix; where the eigenvectors provide a set of basis functions for representing the graph signal in the spectral domain; the eigenvectors can decompose the graph signal into a linear combination of a set of basis functions, thereby representing the frequency domain information of the graph signal as a set of coefficients; and the selection of the linear set of basis functions is based on the properties of the Laplacian matrix and the characteristics of the graph structure, which can be used to construct the frequency domain convolution layer of the graph convolutional neural network; the symmetric normalized Laplacian of the graph G is defined as where A is the adjacency matrix of the graph G, D is the degree matrix of the graph, by solving the eigenvalues and eigenvectors of L sym , the spectral representation of the graph G in the frequency domain can be obtained, which is used to train and design the graph neural network model;

[0028] 3.3) Using a graph neural network based on an improved spectral graph convolution network (GCN) architecture to define the network structure; this improved spectral graph convolution network (GCN) architecture can take the spectral representation of the graph G as input and perform convolution operations in the frequency domain, the formula of spectral convolution operation is as follows H (l) is the node feature representation of the lth layer, is the result of adding a self-loop to the adjacency matrix, is the degree matrix of , W (l) is the weight matrix of the lth layer, σ(·) is the activation function, and the GELU function is selected as the activation function;

[0029] 3.4) input the pretreatment data and the topology structure of the opinion key node into the graph neural network of the improved spectral graph convolution network (GCN) architecture for training; the improved spectral graph convolution network will learn to extract distinguishing features and classify the threat nodes according to the topology information of the nodes in the graph; the optimizer used in the training is SGD, the learning rate is 1e-4, and the loss function is MSE.

[0030] Further to better realize the threat node perception method based on the deep learning graph neural network theory according to the present application, the following setting mode is particularly adopted:

[0031] 4.1) feed the cross-validation subsets obtained in step 1.12) for testing the model into the spectral domain graph model which has been trained to make a prediction, and each time use K-1 cross-validation subsets to train and use the remaining one cross-validation subset to test, and finally obtain the average value of K test results as the final performance index of the model;

[0032] 4.2) evaluate the prediction result of the spectral domain graph model, and calculate the accuracy Accuracy, precision Precision, recall Recall and F1 score index of the spectral domain graph model; wherein the accuracy refers to the ratio of the number of samples correctly predicted by the spectral domain graph model to the total number of samples; the precision refers to the ratio of the number of positive samples correctly predicted by the spectral domain graph model to the total number of positive samples predicted; the recall refers to the ratio of the number of positive samples correctly predicted by the spectral domain graph model to the total number of actual positive samples; the F1 score index considers the precision P and the recall R comprehensively, and is the harmonic mean of the two, which can be used to comprehensively evaluate the performance of the spectral domain graph model, and the formula is as follows:

[0033]

[0034] Wherein TP (True Positive) represents the number of positive samples correctly predicted by the spectral domain graph model; TN (True Negative) represents the number of negative samples correctly predicted by the spectral domain graph model; FP (False Positive) represents the number of negative samples incorrectly predicted as positive samples by the spectral domain graph model; FN (False Negative) represents the number of positive samples incorrectly predicted as negative samples by the spectral domain graph model; P represents the precision; R represents the recall.

[0035] Further to better realize the present application, the following setting mode is particularly adopted: the improved spectral graph convolution network (GCN) architecture comprises:

[0036] Input layer: the input layer takes the graph signal X as input, which is an N x F matrix, wherein N is the number of nodes in the graph, and F is the number of features of each node;

[0037] Improved graph convolution layer: a spectral decomposition convolution is used to perform convolution operation on the graph, the Laplacian matrix is spectrally decomposed to obtain its eigenvalue and eigenvector, then the eigenvector is taken as the coefficient of the filter to perform spectral filtering on the input graph signal, so as to improve the spectral filtering capability of the graph signal and enhance the classification performance of the model; the calculation process of the spectral decomposition convolution is represented as three steps: eigenvalue decomposition, frequency domain filtering and eigenvalue reconstruction; the Laplacian matrix of the graph is L, the eigenvalue is λ, and the eigenvector matrix is U, then L can be expressed as: L = UΛU T , where Λ is a diagonal matrix, the elements on the diagonal are eigenvalues λ; each column of the eigenvector matrix U is an eigenvector of the Laplacian matrix and is regarded as the coefficient of the filter; for the input graph signal X ∈ R N×F , first project it on the eigenvector matrix U to obtain: Then the is frequency domain filtered to obtain: , where α is a parameter for controlling the cutoff frequency of the filter, and the is projected back to the original feature space to obtain the output graph signal Y, and The output of the graph convolution layer is a new graph signal X', which is an N x F' matrix, where F' is the number of output features of each node;

[0038] Pooling layer: the nodes are divided into different subgraphs, and then the pooling operation is performed on each subgraph to reduce the dimension and increase the nonlinearity;

[0039] Batch Normalization layer: this layer is used to normalize the output of the previous layer, to solve the problems of gradient disappearance and gradient explosion, so as to speed up the convergence and improve the robustness;

[0040] GELU Activation layer: GELU Gaussian error linear unit activation function is used, GELU is a differentiable nonlinear function, which has a very small slope in the area close to zero, used to slow down the gradient disappearance problem, and introduce nonlinearity in the activation function, so as to enhance the representation ability of the model;

[0041] Dropout layer: this layer randomly discards a certain proportion of node feature vectors to avoid overfitting;

[0042] Improved graph attention mechanism layer: can be used to capture the importance between nodes, so as to weight the aggregation of node features, in this layer, multi-head attention mechanism is used, which can make the model learn multiple different attention representations, so as to strengthen the attention degree of different nodes and improve the perception ability of threat nodes; Each node has a vector representing its features, and the graph attention mechanism takes these vectors as input and maps them to an attention vector; Then, the attention vector is used to calculate the weighted sum of each node; The output of the improved graph attention mechanism layer is a new graph signal X'', which is an N x F'' matrix, where F'' is the number of output features of each node;

[0043] Fully connected layer: connect the multi-head attention representation and perform matrix multiplication operation to obtain a final node feature vector;

[0044] Graph pooling layer: aggregate information from multiple nodes to generate higher-level node representations; The output of the graph pooling layer is a new graph signal X''', which is an M x F''' matrix, where M is the number of pooled nodes and F''' is the number of output features of each pooled node;

[0045] Output layer: this layer takes the node features after multiple graph convolution and pooling operations as input, and uses the softmax function to map them to a probability distribution, which represents the probability of each node belonging to each class; The output of this layer is used for node classification tasks, and its mathematical expression is as follows: Where, is the feature of the jth node on the pooling layer,

[0046] W (L) and b (L) are the weights and biases from the pooling layer to the output layer, softmax is the activation function, y i is the probability distribution of node i belonging to different classes, and N is the number of nodes in the graph.

[0047] Compared with the prior art, the present application has the following advantages and beneficial effects:

[0048] The present application adopts information features and bad public opinion node topology, which can more accurately perceive potential threat nodes, thereby helping to improve the effect of security warning and threat identification, and achieving more accurate threat node perception effect.

[0049] The improved spectral graph convolution network (GNN) architecture can automatically extract and learn features, greatly improve the analysis efficiency, thereby reducing the labor cost and analysis time, and realizing more efficient automatic analysis effect.

[0050] The application has a wider application scenario: not only suitable for the field of information security, but also applicable to other fields such as social network analysis, financial risk control, etc., and has a wide application prospect. DETAILED DESCRIPTION

[0051] The application will be further described in detail below in conjunction with the embodiments, but the embodiments of the application are not limited thereto.

[0052] To make the purpose, technical scheme and advantages of the embodiments of the application clearer, the technical scheme of the application will be described clearly and completely in conjunction with the embodiments of the application. Obviously, the described embodiments are part of the embodiments of the application, but not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the application. Therefore, the following detailed description of the embodiments of the application is not intended to limit the scope of the claimed application, but only to represent selected embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the application.

[0053] Embodiment 1

[0054] The application designs a threat node perception method based on deep learning graph neural network theory to improve network security performance, detection efficiency and accuracy of threat nodes, including the following steps:

[0055] 1) The original data flow is cleaned, and the Apriori algorithm is used to generate information association rules, and then the steps of feature conversion and data preprocessing are continued to obtain the node feature matrix and the preprocessing data for spectral domain graph model training;

[0056] 2) After step 1), the node feature matrix and the adjacency matrix of the network session information node are combined together to construct the topology structure of the public opinion key node;

[0057] 3) The Fourier transform of the graph is used to convert the time domain signal of the topology structure of step 2) into the frequency domain, and the eigenvalue is solved by using the Laplacian matrix to construct the spectral domain graph model of the public opinion information; and the structure of the graph neural network is defined, and the spectral domain graph model is trained using the preprocessing data and the topology structure of the public opinion key node;

[0058] 4) After the training of the spectral domain graph model is completed, the spectral domain graph model is tested and evaluated: whether the prediction result of the spectral domain graph model is correct is detected using the cross-validation set in the preprocessed data, and the accuracy, precision, recall and F1 score indicators of the spectral domain graph model are calculated.

[0059] Embodiment 2:

[0060] This embodiment is further optimized on the basis of the above-mentioned embodiments, and the same as the foregoing technical solutions will not be repeated here. In order to better implement the threat node perception method based on the deep learning graph neural network theory, the following setting method is particularly adopted:

[0061] 1.1) De-duplication, since the same network packet can be sent multiple times, it is necessary to perform de-duplication processing on the original data to ensure the accuracy and efficiency of subsequent analysis;

[0062] 1.2) Eliminate abnormal data such as packets with a length of 0, packets with the same source IP and destination IP, and packets with abnormal length;

[0063] 1.3) Convert the original data to a format based on network sessions through Apriori data format conversion: where each network session (session) is regarded as a "transaction", and each transaction is composed of network data;

[0064] 1.4) Calculate the support of the list of transactions: first, calculate the support of each item set in the list of transactions, that is, the frequency of the item set appearing in all transactions; the formula for support calculation is as follows: support = number of occurrences of item set / total number of transactions;

[0065] 1.5) Support screening: according to the set support threshold, screen out item sets with support greater than or equal to the threshold, and define such item sets as frequent item sets, where each item set of the frequent item set represents a node set containing several nodes;

[0066] 1.6) Generate association rules: for each frequent item set, generate association rules according to the set confidence threshold; where the confidence of the association rule is defined as the frequency of the consequent of the rule appearing in the antecedent of the rule, and the calculation formula is as follows: confidence = support of rule / support of antecedent;

[0067] 1.7) Confidence screening: according to the set confidence threshold, screen out association rules with confidence greater than or equal to the threshold;

[0068] 1.8) Output frequent item sets and association rules: output frequent item sets and association rules that meet the support and confidence threshold requirements;

[0069] 1.9) Transform the association rules obtained in step 1.8) into a node feature matrix: represent each item set of the frequent item set as a node set, which contains several nodes, and represent the connection strength between each node and the association rule as an element in the node feature matrix; in the node feature matrix, each row corresponds to a node, and each column corresponds to an association rule; if there is a connection between a certain node and a certain association rule, the corresponding node feature matrix element value is a non-zero real number, otherwise it is zero;

[0070] 1.10) Calculate the connection strength: after transforming the association rules into the node feature matrix, use the support in the association rules to represent the connection strength between the node and the association rule;

[0071] 1.11) Normalize the node feature matrix using the "max-min normalization" method to eliminate the difference between the feature values and ensure that different features have the same scale and range;

[0072] 1.12) Use the node feature matrix processed in step 1.11) as a data set, and use the K-fold cross-validation method to divide the data set, i.e. divide the data set into K equal-sized cross-validation subsets for subsequent model training and testing.

[0073] Embodiment 3:

[0074] This embodiment is further optimized on the basis of any of the above embodiments, and the same as the previous technical solutions will not be repeated here. In order to better realize the threat node perception method based on the deep learning graph neural network theory, the following setting method is particularly adopted:

[0075] 2.1) Obtain the connection between nodes by analyzing the network session information in the original data to construct an adjacency matrix, each network session is regarded as a node, and the communication between different sessions is regarded as the connection between nodes. According to the interaction between sessions, an adjacency matrix is constructed to describe the connection between nodes;

[0076] 2.2) Splice the adjacency matrix constructed in step 2.1) and the normalized node feature matrix in step 1.11) to form a new matrix; take the new matrix as a graph data structure, and this new graph data structure is a representation form of the public opinion key node topology structure, wherein the nodes of the graph data structure correspond to the rows in the new matrix, and the edges between the nodes correspond to the non-zero elements in the adjacency matrix; in this way, a graph data structure centered on the public opinion key node is obtained, wherein each node includes its feature information and the connection with other nodes.

[0077] Embodiment 4:

[0078] This embodiment is further optimized on the basis of any of the above embodiments, and the same as the foregoing technical solutions will not be repeated here. In order to better implement the threat node perception method based on deep learning graph neural network theory, the following setting method is particularly adopted:

[0079] 3.1) The time domain signal is converted to the frequency domain by applying the Fourier transform of the graph to the adjacency matrix, and the resulting spectral representation captures important features of the graph topology and is used for further analysis. Specifically, the Fourier transform of the graph G with adjacency matrix A is defined as where φ j is the jth eigenvector of the graph, φ1, φ2, …, φ n is the eigenvector of the graph, λ is the corresponding eigenvalue, represents the representation of the signal f in the frequency domain; the inverse Fourier transform formula is as follows where φ * j is the complex conjugate of φ j ;

[0080] 3.2) The eigenvalues and eigenvectors of the graph are solved using the Laplacian matrix; the eigenvectors provide a set of basis functions for representing the graph signal in the spectral domain; the eigenvectors can decompose the graph signal into a linear combination of a series of basic functions, thereby representing the frequency domain information of the graph signal as a set of coefficients; the selection of the linear set of basic functions is based on the properties of the Laplacian matrix and the characteristics of the graph structure, and can be used to construct the frequency domain convolution layer of the graph convolutional neural network; the symmetric normalized Laplacian of the graph G is defined as where A is the adjacency matrix of the graph G, and D is the degree matrix of the graph, which is obtained by solving the eigenvalues and eigenvectors of L sym , the representation of the graph G in the frequency domain is obtained, which is used to train and design the graph neural network model;

[0081] 3.3) A graph neural network based on an improved spectral graph convolution network (GCN) architecture is used to define the network structure; this improved spectral graph convolution network (GCN) architecture can take the spectral representation of the graph G as input and perform convolution operations in the frequency domain, and the spectral convolution operation formula is as follows H (l) is the node feature representation of the lth layer, is the result of adding a self-loop to the adjacency matrix, is the degree matrix of , W (l)is the weight matrix of the first layer, and is the activation function, and the GELU function is selected as the activation function;

[0082] 3.4) The preprocessed data and the topology structure of the opinion key node are input into the graph neural network of the improved spectral graph convolution network (GCN) architecture for training; the improved spectral graph convolution network will learn to extract distinguishing features and classify threat nodes according to the topological information of the nodes in the graph; the optimizer used during training is SGD, the learning rate is 1e-4, and the loss function is MSE.

[0083] Embodiment 5:

[0084] This embodiment is further optimized on the basis of any of the above embodiments, and the same as the foregoing technical solutions will not be repeated here. In order to better implement the threat node perception method based on deep learning graph neural network theory, the following setting method is particularly adopted: the step 4) comprises the following steps:

[0085] 4.1) The cross-validation subset obtained in step 1.12) for testing the model is fed into the spectral domain graph model that has been trained for prediction, and each time K-1 cross-validation subsets are used for training, and the remaining one cross-validation subset is used for testing, and finally the average value of the K test results is obtained as the final performance index of the model;

[0086] 4.2) The prediction results of the spectral domain graph model are evaluated, and the accuracy Accuracy, precision Precision, recall Recall and F1 score indicators of the spectral domain graph model are calculated; wherein the accuracy refers to the ratio of the number of samples correctly predicted by the spectral domain graph model to the total number of samples; the precision P refers to the ratio of the number of positive samples correctly predicted by the spectral domain graph model to the total number of positive samples predicted; the recall R refers to the ratio of the number of positive samples correctly predicted by the spectral domain graph model to the total number of actual positive samples; the F1 score indicator considers the precision P and the recall R comprehensively, and is the harmonic mean of the two, which can be used to comprehensively evaluate the performance of the spectral domain graph model, and its formula is as follows:

[0087]

[0088] Wherein, TP (True Positive) represents the number of positive samples correctly predicted by the spectral domain graph model; TN (True Negative) represents the number of negative samples correctly predicted by the spectral domain graph model; FP (False Positive) represents the number of negative samples incorrectly predicted as positive samples by the spectral domain graph model; FN (False Negative) represents the number of positive samples incorrectly predicted as negative samples by the spectral domain graph model; P represents the precision; R represents the recall.

[0089] Embodiment 6:

[0090] The embodiment is further optimized on the basis of any of the above embodiments, and the same parts as the foregoing technical solutions will not be described again. To better implement the threat node perception method based on the deep learning graph neural network theory, the following setting mode is particularly adopted: the improved spectral graph convolution network (GCN) architecture comprises:

[0091] An input layer: the input layer takes a graph signal X as input, which is an N x F matrix, where N is the number of nodes in the graph, and F is the number of features of each node;

[0092] An improved graph convolution layer: spectral decomposition convolution is adopted to perform convolution operation on the graph, the Laplacian matrix is subjected to spectral decomposition to obtain its eigenvalues and eigenvectors, then the eigenvectors are taken as the coefficients of the filter to perform spectral filtering on the input graph signal, thereby improving the spectral filtering capability of the graph signal and enhancing the classification performance of the model; the calculation process of the spectral decomposition convolution is represented by three steps: eigenvalue decomposition, frequency domain filtering and eigenvalue reconstruction; the Laplacian matrix of the graph is L, the eigenvalue is λ, and the eigenvector matrix is U, then L can be expressed as: L = UΛU T , where Λ is a diagonal matrix, the elements on the diagonal are eigenvalues λ; each column of the eigenvector matrix U is an eigenvector of the Laplacian matrix and is regarded as a coefficient of the filter; for the input graph signal X ∈ R N×F , it is first projected on the eigenvector matrix U to obtain: Then the is subjected to frequency domain filtering to obtain: , where α is a parameter for controlling the cutoff frequency of the filter, and the is projected back to the original feature space to obtain the output graph signal Y, and The output of the graph convolution layer is a new graph signal X', which is an N x F' matrix, where F' is the number of output features of each node;

[0093] A pooling layer: the nodes are divided into different subgraphs, and then a pooling operation is performed on each subgraph to reduce the dimension and increase the nonlinearity;

[0094] A batch normalization layer: the layer is used to normalize the output of the previous layer to solve the problems of gradient disappearance and gradient explosion, thereby accelerating the convergence speed and improving the robustness;

[0095] GELU Activation layer: uses GELU Gaussian Error Linear Unit activation function, GELU is a differentiable nonlinear function that has a very small slope in the region near zero, which is used to alleviate the problem of gradient vanishing, and introduces nonlinearity in the activation function, thereby enhancing the representation ability of the model;

[0096] Dropout layer: this layer randomly discards a certain proportion of node feature vectors to avoid overfitting;

[0097] Improved graph attention mechanism layer: can be used to capture the importance between nodes, so as to weight and aggregate node features; in this layer, multi-head attention mechanism is used, which allows the model to learn multiple different attention representations, thereby strengthening the attention degree of different nodes and improving the perception ability of threat nodes; each node has a vector representing its features, and the graph attention mechanism takes these vectors as input and maps them to an attention vector; then, the attention vector is used to calculate the weighted sum of each node; the output of the improved graph attention mechanism layer is a new graph signal X”, which is an N x F” matrix, where F” is the number of output features of each node;

[0098] Fully Connected layer: connects multi-head attention representations and performs matrix multiplication to obtain a final node feature vector;

[0099] Graph pooling layer: aggregates information from multiple nodes to generate higher-level node representations; the output of the graph pooling layer is a new graph signal X”', which is an M x F”' matrix, where M is the number of pooled nodes and F”' is the number of output features of each pooled node;

[0100] Output layer: this layer takes the node features after multiple graph convolution and pooling operations as input, and uses the softmax function to map them to a probability distribution, which represents the probability of each node belonging to each class; the output of this layer is used for node classification tasks, and its mathematical expression is as follows: where, is the feature of the jth node on the pooling layer, W (L) and b (L) are the weights and biases from the pooling layer to the output layer, softmax is the activation function, y i is the probability distribution of node i belonging to different classes, and N is the number of nodes in the graph.

[0101] The above is only the preferred embodiment of the present application, and does not limit the present application in any form. Any simple modification or equivalent change of the above embodiment according to the technical essence of the present application falls within the protection scope of the present application.

Claims

1. A threat node awareness method based on deep learning graph neural network theory, characterized in that: Comprise the following steps: 1) data cleaning is performed on the original data flow, and information association rules are generated using the Apriori algorithm, and then feature conversion and data preprocessing steps are performed to obtain a node feature matrix and preprocessed data for spectral domain graph model training; 2) After step 1), the node feature matrix and the adjacency matrix of the network session information node are combined together to construct the topology of the public opinion key node; 3) Using the Fourier transform of the graph, the time domain signal of the topology structure in step 2) is converted into the frequency domain, and the eigenvalues are solved using the Laplacian matrix to construct a spectral domain graph model of public opinion information; And define the structure of the graph neural network, input the preprocessed data and the topology structure of the public opinion key node into the improved spectral graph convolution network architecture of the graph neural network for training; the improved spectral graph convolution network learns to extract and distinguish features and classifies threat nodes according to the topology information of the nodes in the graph; wherein, the improved spectral graph convolution network architecture comprises: The input layer: the input layer takes the graph signal X as input, which is an N x F matrix, where N is the number of nodes in the graph and F is the number of features of each node; Improved graph convolution layer: spectral decomposition convolution is used for convolution operation on the graph, the Laplacian matrix is spectrally decomposed to obtain its eigenvalues and eigenvectors, and then the eigenvectors are used as the coefficients of the filter to perform spectral filtering on the input graph signal, thereby improving the spectral filtering capability of the graph signal and enhancing the classification performance of the model; Improved graph attention mechanism layer: used to capture the importance between nodes, thereby weighting and aggregating node features; in the improved graph attention mechanism layer, a multi-head attention mechanism is used, which allows the model to learn multiple different attention representations, thereby strengthening the attention degree of different nodes and improving the threat node perception ability; each node has a vector representing its features, and the graph attention mechanism takes these vectors as input and maps them to an attention vector; then, the attention vector is used to calculate the weighted sum of each node; the output of the improved graph attention mechanism layer is a new graph signal X", which is an N x F" matrix, where F" is the number of output features of each node; Output layer: the node features after multi-layer graph convolution and pooling operations are taken as input, and a softmax function is used to map them to a probability distribution representing the probability of each node belonging to each class; the output of this output layer is used for node classification tasks, and its mathematical expression is as follows: wherein, is the feature of the jth node on the aggregation layer, W (L) and b (L) are the weights and bias from the aggregation layer to the output layer, softmax is the activation function, y i is the probability distribution of node i belonging to different classes, and N is the number of nodes in the graph; 4) After completing the training of the spectral domain graph model, test and evaluate the spectral domain graph model: use the cross-validation set in the preprocessed data to detect whether the prediction result of the spectral domain graph model is correct, and calculate the accuracy, precision, recall and F1 score indicators of the spectral domain graph model.

2. The threat node awareness method based on deep learning graph neural network theory according to claim 1, characterized in that: The step 1) comprises the following steps: 1.1) remove duplicate data from the original data; 1.2) remove abnormal data such as data packets with a packet length of 0, data packets with the same source IP and destination IP, and data packets with abnormal packet length; 1.3) convert the original data into a format based on network sessions through Apriori data format conversion: wherein each network session is regarded as a "transaction", and each transaction is composed of network data; 1.4) Support calculation for the list of transactions: first, calculate the support of each item set in the list of transactions, i.e. the frequency of the item set appearing in all transactions; the formula for support calculation is as follows: support = number of occurrences of item set / total number of transactions; 1.5) Support filtering: according to the set support threshold, filter out the item sets with support greater than or equal to the threshold, define such item sets as frequent item sets, wherein each item set of the frequent item set represents a node set, which contains several nodes; 1.6) Generation of association rules: for each frequent item set, generate association rules according to the set confidence threshold; wherein the confidence of the association rule is defined as the frequency of the consequent of the rule appearing in the antecedent of the rule, and the calculation formula is as follows: confidence = support of rule / support of antecedent; 1.7) Confidence filtering: according to the set confidence threshold, filter out the association rules with confidence greater than or equal to the threshold; 1.8) Output of frequent item sets and association rules: output the frequent item sets and association rules that meet the support and confidence threshold requirements; 1.9) Conversion of association rules obtained in step 1.8) into a node feature matrix: each item set of the frequent item set represents a node set, which contains several nodes, and the connection strength between each node and the association rule is represented as an element in the node feature matrix; in the node feature matrix, each row corresponds to a node and each column corresponds to an association rule; if there is a connection between a certain node and a certain association rule, the corresponding node feature matrix element value is a non-zero real number, otherwise it is zero; 1.10) Calculation of connection strength: after converting the association rules into the node feature matrix, use the support in the association rules to represent the connection strength between the node and the association rule; 1.11) Normalization of the node feature matrix using the "max-min normalization" method to eliminate the difference in feature values and ensure that different features have the same scale and range; 1.12) Use the node feature matrix processed in step 1.11) as the data set, and use the K-fold cross-validation method to divide the data set, i.e. divide the data set into K equal-sized cross-validation subsets for subsequent model training and testing.

3. The method of claim 2, wherein the method is based on a deep learning graph neural network theory. The step 2) comprises the following steps: 2.1) Obtain the connection between nodes by analyzing the network session information in the original data to construct an adjacency matrix, each network session is regarded as a node, and the communication between different sessions is regarded as the connection between nodes, and the adjacency matrix is constructed to describe the connection between nodes according to the interaction between sessions; 2.2) Concatenate the adjacency matrix constructed in step 2.1) with the normalized node feature matrix in step 1.11) to form a new matrix; use the new matrix as a graph data structure, wherein the nodes of the graph data structure correspond to the rows in the new matrix, and the edges between the nodes correspond to the non-zero elements in the adjacency matrix; in this way, a graph data structure centered on the public opinion key node is obtained, wherein each node includes its feature information and connection with other nodes.

4. The method of claim 3, wherein the method is based on a deep learning graph neural network theory. The step 3) comprises the following steps: 3.1) Transforming the time domain signal into the frequency domain by applying the Fourier transform of a graph to the adjacency matrix, the resulting spectrum captures important features of the graph topology and is used for further analysis, in particular: the Fourier transform of a graph G with adjacency matrix A is defined as where φ j is the j-th eigenvector of the graph, φ1, φ2,..., φ n are the eigenvectors of the graph, λ are the corresponding eigenvalues, denotes the representation of the signal f in the frequency domain; the inverse Fourier transform formula is as follows where φ * j is the complex conjugate of φ j ; 3.2) solving the eigenvalues and eigenvectors of the graph using the Laplacian matrix; wherein the eigenvectors provide a set of basis functions for representing the graph signal in the spectral domain; the eigenvectors decompose the graph signal into a linear combination of a set of basis functions, thereby representing the frequency domain information of the graph signal as a set of coefficients; and the selection of the linear set of basis functions is based on the properties of the Laplacian matrix and the characteristics of the graph structure for constructing the frequency domain convolution layers of the graph convolutional neural network; the symmetric normalized Laplacian matrix of the graph G is defined as where A is the adjacency matrix of the graph G, and D is the degree matrix of the graph, by solving the eigenvalues and eigenvectors of L sym to obtain the representation of the graph G in the frequency domain; 3.3) using a graph neural network based on an improved spectral graph convolution network architecture to define the network structure; the improved spectral graph convolution network architecture takes the spectral representation of the graph G as input and performs convolution operation in the frequency domain, and the formula of the spectral convolution operation is as follows H (l) is the node feature representation of the lth layer, is the result of adding a self-loop to the adjacency matrix, is the degree matrix of (l) is the weight matrix of the lth layer, and σ(·) is an activation function, and the GELU function is selected as the activation function; Wherein, the optimizer used in training the improved graph neural network of the spectral graph convolution network architecture is SGD, the learning rate is 1e-4, and the loss function is MSE.

5. The method of claim 2, wherein the method is based on a deep learning graph neural network theory. The step 4) comprises the following steps: 4.1) feeding the cross-validation subsets for testing the model obtained in step 1.12) into the spectral domain graph model which has been trained for prediction, each time using K-1 cross-validation subsets for training and the remaining one cross-validation subset for testing, and finally obtaining the average value of K test results as the final performance indicator of the model; 4.2) evaluating the prediction results of the spectral domain graph model, and calculating the accuracy Accuracy, precision Precision, recall Recall and F1 score indicators of the spectral domain graph model; wherein the accuracy refers to the ratio of the number of samples correctly predicted by the spectral domain graph model to the total number of samples; the precision refers to the ratio of the number of positive samples correctly predicted by the spectral domain graph model to the total number of positive samples predicted; the recall refers to the ratio of the number of positive samples correctly predicted by the spectral domain graph model to the total number of actual positive samples; the F1 score indicator considers the precision P and the recall R comprehensively, and is the harmonic mean of the two, used to comprehensively evaluate the performance of the spectral domain graph model, and its formula is as follows: Wherein, TP represents the number of positive samples correctly predicted by the spectral domain graph model; TN represents the number of negative samples correctly predicted by the spectral domain graph model; FP represents the number of negative samples incorrectly predicted as positive samples by the spectral domain graph model; FN represents the number of positive samples incorrectly predicted as negative samples by the spectral domain graph model; P represents the precision; R represents the recall.

6. The method of claim 5, wherein the method is based on a deep learning graph neural network theory. The improved spectral graph convolution network architecture further comprises: Pooling layer: divide the nodes into different subgraphs, and then perform pooling operation on each subgraph, for reducing dimension and increasing nonlinearity; Batch Normalization layer: used to normalize the output of the previous layer, solve the problem of gradient vanishing and gradient explosion, thereby speed up the convergence speed and improve its robustness; GELU Activation layer: using GELU Gaussian Error Linear Unit activation function, GELU is a differentiable nonlinear function, which has very small slope in the area close to zero, used to slow down the gradient vanishing problem, and introduce nonlinearity in the activation function, thereby enhancing the representation ability of the model; Dropout layer: randomly discard a certain proportion of node feature vectors to avoid overfitting; Fully Connected layer: connect the multi-head attention representation and perform matrix multiplication operation to obtain a final node feature vector; Graph pooling layer: aggregates information from multiple nodes to generate higher-level node representations; the output of the graph pooling layer is a new graph signal X”', which is an M x F”' matrix, where M is the number of pooled nodes and F”' is the number of output features of each pooled node; The calculation process of spectral decomposition convolution is represented as three steps: eigenvalue decomposition, frequency domain filtering, and eigenvalue reconstruction. The Laplacian matrix of a graph is L, the eigenvalue is λ, and the eigenvector matrix is U. L is represented as: L = UΛU T where Λ is a diagonal matrix, the elements on the diagonal are eigenvalues λ; each column of the eigenvector matrix U is an eigenvector of the Laplacian matrix and is regarded as a coefficient of the filter; for the input graph signal X ∈ R N×F , it is first projected on the eigenvector matrix U to obtain: Then, the frequency domain filtering is performed on to obtain: where α is a parameter for controlling the cutoff frequency of the filter, and is projected back to the original eigenvalue space to obtain the output graph signal Y, and The output of the graph convolution layer is a new graph signal X', which is an N x F' matrix, where F' is the number of output features of each node.

Images