Traffic feature extraction, malicious traffic detection method, device, equipment and medium
By constructing traffic topology maps and interaction models on both the client and server sides and integrating multiple features, the problem of encrypted traffic detection was solved, achieving more comprehensive feature extraction and more efficient malicious traffic identification.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING TOPSEC NETWORK SECURITY TECH
- Filing Date
- 2023-08-18
- Publication Date
- 2026-05-29
AI Technical Summary
Existing deep packet inspection methods cannot achieve fine-grained real-time analysis of encrypted traffic. Traditional methods have shortcomings in traffic feature selection and extraction, leading to difficulties in network traffic detection and classification.
By acquiring network traffic data packets, a traffic topology graph of the client and server is constructed. Combined with data packet interaction information, a traffic interaction topology model is established. The graph structure and node attribute features of the client and server are extracted, and the original byte, spatiotemporal and short-term statistical features are integrated to form a more comprehensive traffic feature.
It improves the effectiveness and versatility of traffic feature extraction, can more accurately identify encrypted traffic, improves the accuracy and speed of detection, and has high generalization ability.
Smart Images
Figure CN116915490B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of data processing technology, and more specifically, to a method, apparatus, device, and medium for traffic feature extraction and malicious traffic detection. Background Technology
[0002] To enhance the security of data transmission in communication networks, traffic encryption has become an essential choice for most systems, contributing to improved data confidentiality, integrity, and availability. However, traffic encryption also presents challenges for network traffic detection, classification, and identification. Traditional deep packet inspection methods are no longer sufficient for fine-grained real-time traffic analysis. To address this, researchers have proposed rule-based, traditional machine learning-based, and deep learning-based methods for encrypted traffic analysis. The effectiveness of these methods is closely related to the selection and extraction of network traffic features. How to quickly extract distinctive network traffic features is a pressing technical problem that needs to be solved. Summary of the Invention
[0003] The purpose of some embodiments of this application is to provide a method, apparatus, device, and medium for traffic feature extraction and malicious traffic detection. Through the technical solutions of the embodiments of this application, network traffic data packets during a session are acquired; based on the network traffic data packets, a feature vector sequence corresponding to the network traffic data packets is determined, wherein the feature vector sequence includes a client-side feature vector sequence and a server-side feature vector sequence; based on the client-side feature vector sequence, a client-side traffic topology map corresponding to the client-side feature vector sequence is determined; based on the server-side feature vector sequence, a server-side traffic topology map corresponding to the server-side feature vector sequence is determined; and based on the client-side traffic topology... The figure shows the server-side traffic topology diagram and the data packet interaction information between the client and the server. A traffic interaction topology model corresponding to the network traffic data packets is determined. Based on the traffic interaction topology model, traffic characteristics corresponding to the network traffic data packets are determined. In this embodiment, not only the traffic topology diagram formed by the data packet interaction between the client and the server is considered, but also the graph structure information and node attribute information formed by the data packets of the client or server itself are considered. Since the topologies generated by the client or server differ under different applications and services, this helps to extract more comprehensive and distinctive traffic characteristics, further improving the effectiveness and versatility of the traffic characteristic extraction method.
[0004] In a first aspect, some embodiments of this application provide a traffic feature extraction method, including: acquiring network traffic data packets during a session;
[0005] Based on the network traffic data packets, a feature vector sequence corresponding to the network traffic data packets is determined, wherein the feature vector sequence includes a client feature vector sequence and a server feature vector sequence;
[0006] Based on the client feature vector sequence, determine the client traffic topology map corresponding to the client feature vector sequence;
[0007] Based on the server-side feature vector sequence, determine the server-side traffic topology corresponding to the server-side feature vector sequence;
[0008] Based on the client traffic topology map, the server traffic topology map, and the data packet interaction information between the client and the server, a traffic interaction topology model corresponding to the network traffic data packet is determined.
[0009] Based on the traffic interaction topology model, the traffic characteristics corresponding to the network traffic data packets are determined.
[0010] Some embodiments of this application establish client-side traffic topology graphs and server-side traffic topology graphs, as well as data packet interaction information between the client and server, to determine the traffic interaction topology model corresponding to the network traffic data packets. This allows for traffic feature extraction of the network traffic data packets. It considers not only the traffic topology graph formed by the data packet interaction between the client and server, but also the graph structure information and node attribute information formed by the data packets of the client or server itself. Since the topology generated by the client or server varies under different applications and services, this approach helps to extract more comprehensive and distinctive traffic features, further improving the effectiveness and versatility of the feature extraction method.
[0011] Optionally, determining the feature vector sequence corresponding to the network traffic data packet based on the network traffic data packet includes:
[0012] The network traffic data packets are preprocessed to obtain processed network traffic data packets, wherein the network traffic data packets include at least client traffic data packets and server traffic data packets;
[0013] Obtain the data packet feature information of the processed network traffic data packets, wherein the data packet feature information includes at least the original byte features, spatiotemporal features and short-term statistical features of the data packets;
[0014] The data packet feature information is vectorized to obtain a feature vector sequence corresponding to the data packet feature information.
[0015] Some embodiments of this application effectively integrate traffic interaction features, raw byte features, spatiotemporal features, and short-term statistical features, and set the integrated features as data packet node attributes to extract more comprehensive encrypted traffic features, thereby improving the effectiveness and versatility of the feature extraction method.
[0016] Optionally, determining the client traffic topology map corresponding to the client feature vector sequence based on the client feature vector sequence includes:
[0017] Each of the client traffic data packets is identified as a first topology graph node;
[0018] The client feature vector sequence is determined as the node attribute of the first topology graph node;
[0019] The data packets transmitted in the same direction within a preset time period by the client traffic data packets are determined to be the first cluster set;
[0020] Based on the first cluster set, determine the first set of connecting edges;
[0021] The client traffic topology is determined based on the first topology graph node, the node attributes of the first topology graph node, and the first set of connecting edges.
[0022] Some embodiments of this application not only consider the graph structure information formed by the interaction of data packets between the client and the server, but also the graph structure information and node attribute information formed by the client's own data packets. Since the topology generated by the client or server varies under different applications and services, this helps to extract more comprehensive and distinctive traffic features, further improving the effectiveness and versatility of the feature extraction method.
[0023] Optionally, determining the server-side traffic topology map corresponding to the server-side feature vector sequence based on the server-side feature vector sequence includes:
[0024] Each of the server-side traffic data packets is identified as a node in the second topology graph.
[0025] The server-side feature vector sequence is determined as the node attribute of the second topology graph node;
[0026] The data packets transmitted in the same direction within a preset time period on the server-side traffic data packets are identified as the second cluster set;
[0027] Based on the second cluster set, determine the second set of connecting edges;
[0028] The server-side traffic topology is determined based on the second topology graph node, the node attributes of the second topology graph node, and the second set of connecting edges.
[0029] Some embodiments of this application not only consider the graph structure information formed by the interaction of data packets between the client and the server, but also the graph structure information and node attribute information formed by the data packets of the server itself. Since the topology generated by the client or the server varies under different applications and services, it helps to extract more comprehensive and distinctive traffic features, and further improves the effectiveness and versatility of the feature extraction method.
[0030] Optionally, determining the traffic interaction topology model corresponding to the network traffic data packet based on the client traffic topology map, the server traffic topology map, and the data packet interaction information between the client and the server includes:
[0031] Based on the data packet interaction information between the client and the server, a third set of connection edges is established during the data packet interaction process between adjacent clients and the server.
[0032] Based on the client traffic topology graph, the server traffic topology graph, and the third set of connection edges, a traffic interaction topology model corresponding to the network traffic data packet is determined.
[0033] Some embodiments of this application not only consider the graph structure information formed by the interaction of data packets between the client and the server, but also the graph structure information and node attribute information formed by the data packets of the server and the client themselves. Since the topology generated by the client or the server varies under different applications and services, it helps to extract more comprehensive and distinctive traffic features, and further improves the effectiveness and versatility of the feature extraction method.
[0034] Secondly, some embodiments of this application provide a method for detecting malicious traffic, including: acquiring network traffic to be detected;
[0035] Based on the network traffic to be detected and the pre-trained node feature extraction model, the node feature information corresponding to the network traffic to be detected is determined; wherein, the pre-trained node feature extraction model is obtained by acquiring sample traffic data using the traffic feature extraction method described in the first aspect, and training a graph neural network model based on the sample traffic data;
[0036] The node feature information is converted into graph-level feature information of the traffic interaction topology;
[0037] Based on a pre-set classification algorithm, the graph-level feature information is classified to determine whether the network traffic to be detected is malicious traffic.
[0038] Some embodiments of this application train a graph neural network model using sample traffic data obtained in the first aspect to obtain a node feature extraction model, and use the node feature extraction model to obtain node feature information. By processing the node feature information, it is determined whether the network traffic to be detected is malicious traffic. This method is superior to existing methods in terms of detection accuracy and detection speed, and has high generalization and versatility.
[0039] Thirdly, some embodiments of this application provide a traffic feature extraction apparatus, including:
[0040] The first acquisition module is used to acquire network traffic data packets during the session;
[0041] The first determining module is used to determine a feature vector sequence corresponding to the network traffic data packet based on the network traffic data packet, wherein the feature vector sequence includes a client feature vector sequence and a server feature vector sequence;
[0042] The second determining module is used to determine the client traffic topology map corresponding to the client feature vector sequence based on the client feature vector sequence.
[0043] The third determining module is used to determine the server-side traffic topology map corresponding to the server-side feature vector sequence based on the server-side feature vector sequence.
[0044] A module is established to determine the traffic interaction topology model corresponding to the network traffic data packet based on the client traffic topology map, the server traffic topology map, and the data packet interaction information between the client and the server.
[0045] The identification module is used to determine the traffic characteristics corresponding to the network traffic data packets based on the traffic interaction topology model.
[0046] Some embodiments of this application establish client-side traffic topology graphs and server-side traffic topology graphs, as well as data packet interaction information between the client and server, to determine the traffic interaction topology model corresponding to the network traffic data packets. This allows for traffic feature extraction of the network traffic data packets. It considers not only the traffic topology graph formed by the data packet interaction between the client and server, but also the graph structure information and node attribute information formed by the data packets of the client or server itself. Since the topology generated by the client or server varies under different applications and services, this approach helps to extract more comprehensive and distinctive traffic features, further improving the effectiveness and versatility of the feature extraction method.
[0047] Optionally, the first determining module is configured to:
[0048] The network traffic data packets are preprocessed to obtain processed network traffic data packets, wherein the network traffic data packets include at least client traffic data packets and server traffic data packets;
[0049] Obtain the data packet feature information of the processed network traffic data packets, wherein the data packet feature information includes at least the original byte features, spatiotemporal features and short-term statistical features of the data packets;
[0050] The data packet feature information is vectorized to obtain a feature vector sequence corresponding to the data packet feature information.
[0051] Some embodiments of this application effectively integrate traffic interaction features, raw byte features, spatiotemporal features, and short-term statistical features, and set the integrated features as data packet node attributes to extract more comprehensive encrypted traffic features, thereby improving the effectiveness and versatility of the feature extraction method.
[0052] Optionally, the second determining module is configured to:
[0053] Each of the client traffic data packets is identified as a first topology graph node;
[0054] The client feature vector sequence is determined as the node attribute of the first topology graph node;
[0055] The data packets transmitted in the same direction within a preset time period by the client traffic data packets are determined to be the first cluster set;
[0056] Based on the first cluster set, determine the first set of connecting edges;
[0057] The client traffic topology is determined based on the first topology graph node, the node attributes of the first topology graph node, and the first set of connecting edges.
[0058] Some embodiments of this application not only consider the graph structure information formed by the interaction of data packets between the client and the server, but also the graph structure information and node attribute information formed by the client's own data packets. Since the topology generated by the client or server varies under different applications and services, this helps to extract more comprehensive and distinctive traffic features, further improving the effectiveness and versatility of the feature extraction method.
[0059] Optionally, the third determining module is configured to:
[0060] Each of the server-side traffic data packets is identified as a node in the second topology graph.
[0061] The server-side feature vector sequence is determined as the node attribute of the second topology graph node;
[0062] The data packets transmitted in the same direction within a preset time period on the server-side traffic data packets are identified as the second cluster set;
[0063] Based on the second cluster set, determine the second set of connecting edges;
[0064] The server-side traffic topology is determined based on the second topology graph node, the node attributes of the second topology graph node, and the second set of connecting edges.
[0065] Some embodiments of this application not only consider the graph structure information formed by the interaction of data packets between the client and the server, but also the graph structure information and node attribute information formed by the data packets of the server itself. Since the topology generated by the client or the server varies under different applications and services, it helps to extract more comprehensive and distinctive traffic features, and further improves the effectiveness and versatility of the feature extraction method.
[0066] Optionally, the fourth determining module is used to:
[0067] Based on the data packet interaction information between the client and the server, a third set of connection edges is established during the data packet interaction process between adjacent clients and the server.
[0068] Based on the client traffic topology graph, the server traffic topology graph, and the third set of connection edges, a traffic interaction topology model corresponding to the network traffic data packet is determined.
[0069] Some embodiments of this application not only consider the graph structure information formed by the interaction of data packets between the client and the server, but also the graph structure information and node attribute information formed by the data packets of the server and the client themselves. Since the topology generated by the client or the server varies under different applications and services, it helps to extract more comprehensive and distinctive traffic features, and further improves the effectiveness and versatility of the feature extraction method.
[0070] Fourthly, some embodiments of this application provide a malicious traffic detection device, including:
[0071] The second acquisition module is used to acquire the network traffic to be detected;
[0072] The detection module is used to determine the node feature information corresponding to the network traffic to be detected based on the network traffic to be detected and a pre-trained node feature extraction model; wherein, the pre-trained node feature extraction model is obtained by acquiring sample traffic data using any of the traffic feature extraction methods described in the first aspect, and training a graph neural network model based on the sample traffic data;
[0073] The conversion module is used to convert the node feature information into graph-level feature information of the traffic interaction topology;
[0074] The classification module is used to classify the graph-level feature information according to a pre-set classification algorithm and determine whether the network traffic to be detected is malicious traffic.
[0075] Some embodiments of this application train a graph neural network model using sample traffic data obtained in the first aspect to obtain a node feature extraction model, and use the node feature extraction model to obtain node feature information. By processing the node feature information, it is determined whether the network traffic to be detected is malicious traffic. This method is superior to existing methods in terms of detection accuracy and detection speed, and has high generalization and versatility.
[0076] Fifthly, some embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it can implement the traffic feature extraction method as described in any embodiment of the first aspect or the malicious traffic detection method as described in the second aspect.
[0077] Sixthly, some embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the traffic feature extraction method as described in any embodiment of the first aspect or the malicious traffic detection method as described in the second aspect.
[0078] In a seventh aspect, some embodiments of this application provide a computer program product, the computer program product including a computer program, wherein when the computer program is executed by a processor, it can implement the traffic feature extraction method as described in any embodiment of the first aspect or the malicious traffic detection method as described in the second aspect. Attached Figure Description
[0079] To more clearly illustrate the technical solutions of some embodiments of this application, the accompanying drawings used in some embodiments of this application will be briefly described below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0080] Figure 1 A flowchart illustrating a traffic feature extraction method provided in an embodiment of this application;
[0081] Figure 2 A schematic diagram illustrating the data packet interaction process between the client and server as provided in an embodiment of this application;
[0082] Figure 3 A design diagram of an encrypted traffic interaction topology model based on a two-layer network provided in this application embodiment;
[0083] Figure 4 A flowchart illustrating a malicious traffic detection method provided in an embodiment of this application;
[0084] Figure 5 This is a schematic diagram of the structure of a flow feature extraction device provided in an embodiment of this application;
[0085] Figure 6 This is a schematic diagram of the structure of a malicious traffic detection device provided in an embodiment of this application;
[0086] Figure 7 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation
[0087] The technical solutions of some embodiments of this application will now be described with reference to the accompanying drawings.
[0088] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.
[0089] To improve the security of data transmission in communication networks, traffic encryption has become an inevitable choice for most systems, which helps improve the confidentiality, integrity, and availability of data. However, traffic encryption also brings challenges to the detection, classification, and identification of network traffic. Traditional methods based on deep packet inspection can no longer achieve fine-grained real-time analysis of traffic. To address this, researchers have successively proposed rule-based, traditional machine learning-based, and deep learning-based encrypted traffic analysis methods. The effectiveness of these methods is closely related to the selection and extraction of network traffic features. Therefore, some embodiments of this application provide a traffic feature extraction method, which includes acquiring network traffic data packets during a session; determining a feature vector sequence corresponding to the network traffic data packets, wherein the feature vector sequence includes a client feature vector sequence and a server feature vector sequence; determining a client traffic topology map corresponding to the client feature vector sequence based on the client feature vector sequence; and determining a feature topology map corresponding to the server feature vector sequence based on the server feature vector sequence. The system generates a server-side traffic topology graph; based on the client-side traffic topology graph, the server-side traffic topology graph, and the data packet interaction information between the client and the server, it determines the traffic interaction topology model corresponding to the network traffic data packets; based on the traffic interaction topology model, it determines the traffic characteristics corresponding to the network traffic data packets. In this embodiment, not only the traffic topology graph formed by the data packet interaction between the client and the server is considered, but also the graph structure information and node attribute information formed by the data packets of the client or server itself are considered. The topologies generated by the client or server under different applications and services are different, which helps to extract more comprehensive and distinguishable traffic characteristics, further improving the effectiveness and universality of the feature extraction method.
[0090] like Figure 1 As shown, an embodiment of this application provides a traffic feature extraction method, which includes:
[0091] S101. Obtain network traffic data packets during the session;
[0092] Specifically, when client devices and server devices transmit data, in order to ensure the security of data transmission, encryption and decryption methods can be pre-agreed between the client devices and server devices during the data transmission process. The data to be transmitted is encrypted using the pre-agreed encryption method before transmission.
[0093] During transmission between the client device and the server device, a security detection device is installed in between. This security detection device can obtain the data packets of the client device and the server device during the session. In this embodiment, the security detection device obtains the network traffic data packets during the session. These network traffic data packets can be encrypted or unencrypted, and no specific limitation is made in this application. Furthermore, the network traffic data packets include data packets sent from the client device to the server device, as well as data packets sent from the server device to the client device.
[0094] S102. Based on the network traffic data packets, determine the feature vector sequence corresponding to the network traffic data packets, wherein the feature vector sequence includes the client feature vector sequence and the server feature vector sequence;
[0095] Specifically, after acquiring network traffic data packets, security detection equipment performs data cleaning on the network traffic data packets, such as filtering out invalid or duplicate data packets; it can also anonymize the network traffic data packets, for example, by hiding the IP addresses in the network traffic data packets, to obtain the processed network traffic data packets.
[0096] The security detection equipment acquires the feature information of the processed network traffic data packets, and performs vectorization on the feature information. Then, it performs standardization or normalization to obtain the feature vector sequence corresponding to the network traffic data packets. The feature vector sequence includes the client feature vector sequence and the server feature vector sequence.
[0097] S103. Based on the client feature vector sequence, determine the client traffic topology map corresponding to the client feature vector sequence;
[0098] Specifically, the security detection equipment uses the client feature vector sequence obtained as the client traffic topology graph, with the data packets corresponding to the client feature vector sequence as the topology graph nodes, and the client feature vector as the node attribute, as well as the connection edges composed of clusters of data packets, to construct the client traffic topology graph corresponding to the client feature vector sequence.
[0099] S104. Based on the server-side feature vector sequence, determine the server-side traffic topology corresponding to the server-side feature vector sequence;
[0100] Specifically, the security detection equipment uses the obtained server-side feature vector sequence as the data packets corresponding to the server-side feature vector sequence as topology graph nodes, and uses the server-side feature vectors as node attributes, as well as the connection edges composed of clusters of data packets, to construct a server-side traffic topology graph corresponding to the server-side feature vector sequence.
[0101] S105. Based on the client traffic topology diagram, the server traffic topology diagram, and the data packet interaction information between the client and the server, determine the traffic interaction topology model corresponding to the network traffic data packets.
[0102] Specifically, after constructing the client traffic topology map and the server traffic topology map, the security detection equipment then uses the interaction information between the client and the server to construct a traffic interaction topology model based on a two-layer network.
[0103] S106. Based on the traffic interaction topology model, determine the traffic characteristics corresponding to the network traffic data packets.
[0104] Specifically, the security detection equipment uses a constructed traffic interaction topology model to calculate traffic characteristics and extract encrypted traffic characteristics. After obtaining the traffic characteristics, it can also be used to identify malicious traffic.
[0105] Some embodiments of this application establish client-side traffic topology graphs and server-side traffic topology graphs, as well as data packet interaction information between the client and server, to determine the traffic interaction topology model corresponding to network traffic data packets. This allows for traffic feature extraction of network traffic data packets. It considers not only the traffic topology graph formed by the interaction of data packets between the client and server, but also the graph structure information and node attribute information formed by the data packets themselves on the client or server. Since the topology generated by the client or server varies under different applications and services, this approach helps to extract more comprehensive and distinctive traffic features, further improving the effectiveness and versatility of the feature extraction method.
[0106] Another embodiment of this application further supplements the description of the traffic feature extraction method provided in the above embodiments.
[0107] Optionally, based on network traffic data packets, a feature vector sequence corresponding to the network traffic data packets is determined, including:
[0108] Preprocessing network traffic data packets yields processed network traffic data packets, which include at least client-side traffic data packets and server-side traffic data packets;
[0109] Obtain the packet feature information of the processed network traffic packets, wherein the packet feature information includes at least the original byte features, spatiotemporal features and short-term statistical features of the packets;
[0110] The data packet feature information is vectorized to obtain a sequence of feature vectors corresponding to the data packet feature information.
[0111] Specifically, in this embodiment of the application, network traffic data packets are preprocessed to obtain processed network traffic data packets, wherein the network traffic data packets include at least client traffic data packets and server traffic data packets;
[0112] The process involves acquiring the packet characteristic information of processed network traffic packets. The original byte characteristics, packet length, and packet arrival interval are selected as the packet characteristic information. This information is then vectorized. The vectorization process reads data byte by byte and converts each byte into an integer between 0 and 255. The original byte characteristics of the data packet are... (N,M) The vector, the short-time statistical characteristics of the data packet are (N, L) The vector, where N The number of data packets captured. M The length of the intercepted data packet. L The value is 2.
[0113] Typically, the first few data packets are responsible for encryption negotiation, connection establishment, sending requests, and data exchange, containing important information about the network flow, and each data packet's header contains metadata about the data packet. On the other hand, short-term statistical features at the packet level, unlike flow-level features, do not require offline computation of the entire flow; their computational overhead is relatively small, and they can be computed in real time.
[0114] Furthermore, vector standardization or normalization of the data packet feature information helps stabilize the training. The original byte vector of the data packet is normalized by dividing each integer by 255. The standardization formula for the short-time statistical features of the data packet is as follows:
[0115]
[0116] in For the standardized vector, For the original vector, This is the average value. The standard deviation is denoted as .
[0117] Some embodiments of this application effectively integrate traffic interaction features, raw byte features, spatiotemporal features, and short-term statistical features, and model the integrated features as data packet node attributes to extract more comprehensive encrypted traffic features, thereby improving the effectiveness and versatility of the feature extraction method.
[0118] Optionally, based on the client feature vector sequence, a client traffic topology map corresponding to the client feature vector sequence is determined, including:
[0119] Each client traffic data packet is designated as the first topology graph node;
[0120] The client feature vector sequence is determined as the node attribute of the first topological graph node;
[0121] The first cluster set is determined based on the data packets transmitted in the same direction within a preset time period of the client traffic data packets;
[0122] Based on the first cluster set, determine the first set of connecting edges;
[0123] The client traffic topology is determined based on the first topology graph node, the node attributes of the first topology graph node, and the first set of connecting edges.
[0124] Specifically, firstly, each network traffic data packet in the client's network data stream is modeled as a node, resulting in a set of data packet nodes. Then, the feature vector corresponding to the client data packet is used as node attributes to obtain the data packet node attribute set. Finally, a series of consecutive data packets transmitted in the same direction within a short time interval in the client network data stream are defined as a cluster. Data packets within a cluster are connected sequentially by edges. The first and last data packets of each cluster are connected to the first and last data packets of the adjacent clusters by edges, respectively, resulting in a set of data packet edges. Through the above operations, the client traffic topology diagram was completed. The construction.
[0125] Some embodiments of this application not only consider the graph structure information formed by the interaction of data packets between the client and the server, but also the graph structure information and node attribute information formed by the client's own data packets. Since the topology generated by the client or server varies under different applications and services, this helps to extract more comprehensive and distinctive traffic features, further improving the effectiveness and versatility of the feature extraction method.
[0126] Optionally, based on the server-side feature vector sequence, a server-side traffic topology map corresponding to the server-side feature vector sequence is determined, including:
[0127] Each server-side traffic data packet is identified as a node in the second topology graph.
[0128] The server-side feature vector sequence is used to determine the node attributes of the nodes in the second topology graph;
[0129] The data packets transmitted in the same direction within a preset time period on the server side are identified as the second cluster set.
[0130] Based on the second cluster set, determine the second set of connecting edges;
[0131] The server-side traffic topology is determined based on the second topology graph nodes, the node attributes of the second topology graph nodes, and the second set of connecting edges.
[0132] Specifically, firstly, each data packet in the server-side data stream is modeled as a node, resulting in a set of data packet nodes. Then, the server-side feature vectors are set as node attributes to obtain the data packet node attribute set. Finally, a series of consecutive data packets transmitted in the same direction within a short time interval in the server-side stream are defined as a cluster. Data packets within a cluster are connected sequentially by edges. The first and last data packets of each cluster are connected to the first and last data packets of the adjacent clusters by edges, respectively, resulting in a set of data packet edges. Through the above operations, the server-side traffic topology diagram was completed. The construction.
[0133] Some embodiments of this application not only consider the graph structure information formed by the interaction of data packets between the client and the server, but also the graph structure information and node attribute information formed by the data packets of the server itself. Since the topology generated by the client or the server varies under different applications and services, it helps to extract more comprehensive and distinctive traffic features, and further improves the effectiveness and versatility of the feature extraction method.
[0134] Optionally, based on the client-side traffic topology map, the server-side traffic topology map, and the data packet interaction information between the client and the server, a traffic interaction topology model corresponding to the network traffic data packets is determined, including:
[0135] Based on the data packet interaction information between the client and the server, a third set of connection edges is established during the data packet interaction process between adjacent clients and the server.
[0136] Based on the client-side traffic topology graph, the server-side traffic topology graph, and the third-party connection edge set, determine the traffic interaction topology model corresponding to the network traffic data packets.
[0137] Specifically, security detection equipment obtains client traffic topology maps. and server-side traffic topology diagram Then, based on the data packet exchange information between the client and the server, connection edges are established between adjacent data packet exchanges between the client and the server, thus obtaining a traffic interaction topology model based on a two-layer network. ,in This represents the set of edges between the client and server traffic topology graphs. This traffic interaction topology model includes not only the data packet interaction characteristics between the client and server, but also the graph structure information and node attribute information formed by their own data packets, which helps to extract more comprehensive traffic features and improves the versatility of the method.
[0138] For example, embodiments of this application provide a traffic feature extraction method, the method comprising:
[0139] Step 1. Data Preprocessing: Network traffic data packets are sequentially processed through network flow segmentation, data cleaning, and data anonymization to obtain a sequence of single encrypted session data packets, such as... Figure 2 The diagram illustrates the data packet interaction process between the client and the server.
[0140] ,in This indicates the first message sent by the client in this session. Data packets, This indicates the number of messages sent by the server in this session. One data packet;
[0141] Step 2. Feature Selection: This method selects the original byte features, packet length, and packet arrival interval of the data packets as packet features. These features are then vectorized. The vectorization process reads data byte by byte, converting each byte into an integer between 0 and 255. The original byte features of the data packets are represented as a vector of (N, M), and the short-term statistical features of the data packets are represented as a vector of (N, L), where N is the number of packets captured, M is the length of the captured packets, and L is 2. When the number of packets is less than N, the actual number of packets is used; when the packet length is less than M, it is padded with zeros. The selected features are then vectorized, standardized, or normalized to obtain the feature vector sequence of the data packets. ,in This indicates the first message sent by the client in this session. Feature vectors of data packets This indicates the number of messages sent by the server in this session. Feature vectors of data packets;
[0142] Step 3. Construct a client traffic topology map, combining it with, for example... Figure 2 A diagram illustrating the data packet interaction process between the client and server, and as shown below. Figure 3 The diagram illustrates a two-layer network-based encrypted traffic interaction topology model, specifically including:
[0143] First, each data packet in the client's data stream is modeled as a node, based on the packet sequence. The client data packet node set is obtained as follows ;
[0144] Among them, here is used Represents a data packet node, and Same meaning;
[0145] Then, the client data packet features extracted in step 2 are modeled as node attributes, based on the feature vector sequence of the data packets. The client data packet node attribute set is obtained as follows ;
[0146] Finally, a series of consecutive data packets transmitted in the same direction within a short time interval in the client stream are defined as a cluster, for example... , , and Intra-cluster data packets are connected sequentially by edges, including , , and The first and last data packets of each cluster are connected to the first and last data packets of the adjacent clusters by edges, including... , , , , and This yields the client data packet edge set. .
[0147] The above operations completed the client traffic topology diagram. The construction.
[0148] Step 4. Construct a server-side traffic topology diagram, similar to step 3, combined with... Figure 2 and Figure 3 The explanation includes:
[0149] First, each data packet in the server-side data stream is modeled as a node, based on the data packet sequence. The server-side data packet node set is obtained as follows ;
[0150] Then, the server-side data packet features extracted in step 2 are modeled as node attributes, based on the feature vector sequence of the data packets. The server-side data packet node attribute set is obtained as follows ;
[0151] Finally, a series of consecutive data packets transmitted in the same direction within a short time interval in the server-side stream are defined as a cluster, for example... , , and Intra-cluster data packets are connected sequentially by edges, including , , and The first and last data packets of each cluster are connected to the first and last data packets of the adjacent clusters by edges, i.e., connecting edges. , , , , and ;
[0152] This yields the set of edges connecting data packets on the server side:
[0153] .
[0154] The above operations completed the server-side traffic topology diagram. The construction.
[0155] Step 5. Construct an encrypted traffic interaction topology model based on a two-layer network, using the client traffic topology diagrams constructed in steps 3 and 4 respectively. and server-side traffic topology diagram Then, based on the data packet interaction information between the client and the server, edges are established between adjacent data packet interactions between the client and the server, resulting in a set of data packet interaction edges. This allows for the construction of an encrypted traffic interaction topology model based on a two-layer network. .
[0156] Step 6. Calculate traffic features based on the encrypted traffic interaction topology model constructed in Step 5, completing the extraction of encrypted traffic features. The traffic features extracted in this embodiment can be combined with graph neural networks to achieve accurate analysis and identification of various encrypted traffic scenarios.
[0157] Some embodiments of this application not only consider the graph structure information formed by the interaction of data packets between the client and the server, but also the graph structure information and node attribute information formed by the data packets of the server and the client themselves. Since the topology generated by the client or the server varies under different applications and services, it helps to extract more comprehensive and distinctive traffic features, and further improves the effectiveness and versatility of the feature extraction method.
[0158] like Figure 4 As shown, an embodiment of this application provides a method for detecting malicious traffic, the method comprising:
[0159] S401. Obtain the network traffic to be detected;
[0160] S402. Based on the network traffic to be detected and the pre-trained node feature extraction model, determine the node feature information corresponding to the network traffic to be detected; wherein, the pre-trained node feature extraction model is obtained by using the above-mentioned traffic feature extraction method to obtain sample traffic data and training the graph neural network model based on the sample traffic data.
[0161] S403. Convert node feature information into graph-level feature information of traffic interaction topology;
[0162] S404. Based on the pre-set classification algorithm, classify the graph-level feature information to determine whether the network traffic to be detected is malicious traffic.
[0163] Specifically, based on the above embodiments, this application uses the traffic feature extraction method in the above embodiments to extract features from the network traffic to be detected, and then uses a graph attention mechanism neural network model for processing, which can be used in encrypted malicious traffic detection scenarios.
[0164] First, using the malicious traffic datasets ISCXIDS2012 and CICIDS2017, the traffic feature extraction described in the above embodiments is performed sequentially to complete the construction of the encrypted traffic interaction topology model, which is then used as the input to the graph neural network model.
[0165] Secondly, the node feature representation of the encrypted traffic topology model is extracted using a graph attention neural network model;
[0166] Then, the node features are collectively transformed into a graph-level feature representation of the traffic interaction topology through global pooling operations, and the graph-level features are classified to determine whether the encrypted traffic is malicious. In this process, the pre-set classification algorithm can be set to binary classification or multi-class classification according to user needs. For example, binary classification can be used to classify traffic into two categories: normal traffic and malicious traffic.
[0167] Finally, if the node feature extraction model training phase requires random parameter initialization, loss calculation, error backpropagation, and gradient descent algorithms to complete parameter updates, save model structure and parameters, etc.
[0168] After the node feature extraction model is trained, experiments are conducted on the test dataset. The experimental results show that the malicious traffic detection method provided in this application has better accuracy and speed than existing methods, and has high generalization and versatility.
[0169] Some embodiments of this application use sample traffic data obtained by the above-described traffic feature extraction method to train a graph neural network model, thereby obtaining a node feature extraction model. The node feature extraction model is then used to obtain node feature information. By processing the node feature information, it is determined whether the network traffic to be detected is malicious traffic. This method is superior to existing methods in terms of detection accuracy and detection speed, and it also has high generalization and versatility.
[0170] It should be noted that each of the implementable methods in this embodiment can be implemented individually or in any combination without conflict. This application does not limit this.
[0171] Another embodiment of this application provides a flow feature extraction apparatus for performing the flow feature extraction method provided in the above embodiments.
[0172] like Figure 5 The diagram shown is a schematic representation of the traffic feature extraction device provided in an embodiment of this application. The traffic feature extraction device includes a first acquisition module 501, a first determination module 502, a second determination module 503, a third determination module 504, an establishment module 505, and an identification module 506, wherein:
[0173] The first acquisition module 501 is used to acquire network traffic data packets during the session;
[0174] The first determining module 502 is used to determine the feature vector sequence corresponding to the network traffic data packet based on the network traffic data packet, wherein the feature vector sequence includes a client feature vector sequence and a server feature vector sequence;
[0175] The second determining module 503 is used to determine the client traffic topology map corresponding to the client feature vector sequence based on the client feature vector sequence;
[0176] The third determining module 504 is used to determine the server-side traffic topology map corresponding to the server-side feature vector sequence based on the server-side feature vector sequence.
[0177] The module 505 is used to determine the traffic interaction topology model corresponding to the network traffic data packets based on the client traffic topology map, the server traffic topology map, and the data packet interaction information between the client and the server.
[0178] The identification module 506 is used to determine the traffic characteristics corresponding to network traffic data packets based on the traffic interaction topology model.
[0179] Some embodiments of this application establish client-side traffic topology graphs and server-side traffic topology graphs, as well as data packet interaction information between the client and server, to determine the traffic interaction topology model corresponding to network traffic data packets. This allows for traffic feature extraction of network traffic data packets. It considers not only the traffic topology graph formed by the interaction of data packets between the client and server, but also the graph structure information and node attribute information formed by the data packets themselves on the client or server. Since the topology generated by the client or server varies under different applications and services, this approach helps to extract more comprehensive and distinctive traffic features, further improving the effectiveness and versatility of the feature extraction method.
[0180] Regarding the apparatus in this embodiment, the specific manner in which each module performs its operations has been described in detail in the embodiments related to the method, and will not be elaborated upon here.
[0181] Another embodiment of this application further illustrates the flow feature extraction device provided in the above embodiments.
[0182] Optionally, the first determining module is used for:
[0183] Preprocessing network traffic data packets yields processed network traffic data packets, which include at least client-side traffic data packets and server-side traffic data packets;
[0184] Obtain the packet feature information of the processed network traffic packets, wherein the packet feature information includes at least the original byte features, spatiotemporal features and short-term statistical features of the packets;
[0185] The data packet feature information is vectorized to obtain a sequence of feature vectors corresponding to the data packet feature information.
[0186] Some embodiments of this application effectively integrate traffic interaction features, raw byte features, spatiotemporal features, and short-term statistical features, and model the integrated features as data packet node attributes to extract more comprehensive encrypted traffic features, thereby improving the effectiveness and versatility of the feature extraction method.
[0187] Optionally, the second determining module is used for:
[0188] Each client traffic data packet is designated as the first topology graph node;
[0189] The client feature vector sequence is determined as the node attribute of the first topological graph node;
[0190] The first cluster set is determined based on the data packets transmitted in the same direction within a preset time period of the client traffic data packets;
[0191] Based on the first cluster set, determine the first set of connecting edges;
[0192] The client traffic topology is determined based on the first topology graph node, the node attributes of the first topology graph node, and the first set of connecting edges.
[0193] Some embodiments of this application not only consider the graph structure information formed by the interaction of data packets between the client and the server, but also the graph structure information and node attribute information formed by the client's own data packets. Since the topology generated by the client or server varies under different applications and services, this helps to extract more comprehensive and distinctive traffic features, further improving the effectiveness and versatility of the feature extraction method.
[0194] Optionally, the third determining module is used for:
[0195] Each server-side traffic data packet is identified as a node in the second topology graph.
[0196] The server-side feature vector sequence is used to determine the node attributes of the nodes in the second topology graph;
[0197] The data packets transmitted in the same direction within a preset time period on the server side are identified as the second cluster set.
[0198] Based on the second cluster set, determine the second set of connecting edges;
[0199] The server-side traffic topology is determined based on the second topology graph nodes, the node attributes of the second topology graph nodes, and the second set of connecting edges.
[0200] Some embodiments of this application not only consider the graph structure information formed by the interaction of data packets between the client and the server, but also the graph structure information and node attribute information formed by the data packets of the server itself. Since the topology generated by the client or the server varies under different applications and services, it helps to extract more comprehensive and distinctive traffic features, and further improves the effectiveness and versatility of the feature extraction method.
[0201] Optionally, the fourth determining module is used for:
[0202] Based on the data packet interaction information between the client and the server, a third set of connection edges is established during the data packet interaction process between adjacent clients and the server.
[0203] Based on the client-side traffic topology graph, the server-side traffic topology graph, and the third-party connection edge set, determine the traffic interaction topology model corresponding to the network traffic data packets.
[0204] Some embodiments of this application not only consider the graph structure information formed by the interaction of data packets between the client and the server, but also the graph structure information and node attribute information formed by the data packets of the server and the client themselves. Since the topology generated by the client or the server varies under different applications and services, it helps to extract more comprehensive and distinctive traffic features, and further improves the effectiveness and versatility of the feature extraction method.
[0205] Another embodiment of this application provides a malicious traffic detection device for performing the malicious traffic detection method provided in the above embodiments.
[0206] like Figure 6 The diagram shown is a structural schematic of a malicious traffic detection device provided in an embodiment of this application. The traffic feature extraction device includes a second acquisition module 601, a detection module 602, a conversion module 603, and a classification module 604, wherein:
[0207] The second acquisition module 601 is used to acquire the network traffic to be detected;
[0208] The detection module 602 is used to determine the node feature information corresponding to the network traffic to be detected based on the network traffic to be detected and the pre-trained node feature extraction model; wherein, the pre-trained node feature extraction model is obtained by using the above-mentioned traffic feature extraction method to obtain sample traffic data and training the graph neural network model based on the sample traffic data;
[0209] The conversion module 603 is used to convert node feature information into graph-level feature information of traffic interaction topology;
[0210] The classification module 604 is used to classify graph-level feature information according to a pre-set classification algorithm to determine whether the network traffic to be detected is malicious traffic.
[0211] Some embodiments of this application use sample traffic data obtained by the above-described traffic feature extraction method to train a graph neural network model, obtain a node feature extraction model, and use the node feature extraction model to obtain node feature information. By processing the node feature information, it is determined whether the network traffic to be detected is malicious traffic. This method is superior to existing methods in terms of detection accuracy and detection speed, and has high generalization and versatility.
[0212] Regarding the apparatus in this embodiment, the specific manner in which each module performs its operations has been described in detail in the embodiments related to the method, and will not be elaborated upon here.
[0213] Regarding the apparatus in this embodiment, the specific manner in which each module performs its operations has been described in detail in the embodiments related to the method, and will not be elaborated upon here.
[0214] It should be noted that each of the implementable methods in this embodiment can be implemented individually or in any combination without conflict. This application does not limit this.
[0215] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, can perform the operation of any of the methods corresponding to the traffic feature extraction methods provided in the above embodiments.
[0216] This application also provides a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operation of any of the methods corresponding to the traffic feature extraction methods provided in the above embodiments.
[0217] like Figure 7 As shown, some embodiments of this application provide an electronic device 700, which includes: a memory 710, a processor 720, and a computer program stored in the memory 710 and executable on the processor 720. When the processor 720 reads the program from the memory 710 via a bus 730 and executes the program, it can implement any of the methods included in the above-described traffic feature extraction method.
[0218] Processor 720 can process digital signals and can include various computing architectures. For example, it can be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 720 can be a microprocessor.
[0219] The memory 710 can be used to store instructions executed by the processor 720 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all of the functions of one or more modules described in the embodiments of this application. The processor 720 of this disclosure embodiment can be used to execute the instructions in the memory 710 to implement the methods shown above. The memory 710 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.
[0220] The above are merely embodiments of this application and are not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.
[0221] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
[0222] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
Claims
1. A method for extracting traffic features, characterized in that, The method includes: Acquire network traffic data packets during a session, wherein the network traffic data packets include at least client traffic data packets and server traffic data packets; Based on the network traffic data packets, a feature vector sequence corresponding to the network traffic data packets is determined, wherein the feature vector sequence includes a client feature vector sequence and a server feature vector sequence; Based on the client feature vector sequence, determine the client traffic topology map corresponding to the client feature vector sequence; Based on the server-side feature vector sequence, determine the server-side traffic topology corresponding to the server-side feature vector sequence; Based on the client traffic topology map, the server traffic topology map, and the data packet interaction information between the client and the server, a traffic interaction topology model corresponding to the network traffic data packet is determined. Based on the traffic interaction topology model, determine the traffic characteristics corresponding to the network traffic data packets; Wherein: determining the client traffic topology map corresponding to the client feature vector sequence based on the client feature vector sequence includes: Each of the client traffic data packets is identified as a first topology graph node; The client feature vector sequence is determined as the node attribute of the first topology graph node; The data packets transmitted in the same direction within a preset time period by the client traffic data packets are determined to be the first cluster set; Based on the first cluster set, determine the first set of connecting edges; The client traffic topology is determined based on the first topology graph node, the node attributes of the first topology graph node, and the first set of connecting edges; The step of determining the server-side traffic topology map corresponding to the server-side feature vector sequence includes: Each of the server-side traffic data packets is identified as a node in the second topology graph. The server-side feature vector sequence is determined as the node attribute of the second topology graph node; The data packets transmitted in the same direction within a preset time period on the server-side traffic data packets are identified as the second cluster set; Based on the second cluster set, determine the second set of connecting edges; The server-side traffic topology is determined based on the second topology graph node, the node attributes of the second topology graph node, and the second set of connecting edges.
2. The flow feature extraction method according to claim 1, characterized in that, The step of determining the feature vector sequence corresponding to the network traffic data packet based on the network traffic data packet includes: The network traffic data packets are preprocessed to obtain processed network traffic data packets; Obtain the data packet feature information of the processed network traffic data packets, wherein the data packet feature information includes at least the original byte features, spatiotemporal features and short-term statistical features of the data packets; The data packet feature information is vectorized to obtain a feature vector sequence corresponding to the data packet feature information.
3. The flow feature extraction method according to claim 1, characterized in that, The step of determining the traffic interaction topology model corresponding to the network traffic data packet based on the client traffic topology map, the server traffic topology map, and the data packet interaction information between the client and the server includes: Based on the data packet interaction information between the client and the server, a third set of connection edges is established during the data packet interaction process between adjacent clients and the server. Based on the client traffic topology graph, the server traffic topology graph, and the third set of connection edges, a traffic interaction topology model corresponding to the network traffic data packet is determined.
4. A method for detecting malicious traffic, characterized in that, The method includes: Obtain the network traffic to be detected; Based on the network traffic to be detected and the pre-trained node feature extraction model, the node feature information corresponding to the network traffic to be detected is determined; wherein, the pre-trained node feature extraction model is obtained by acquiring sample traffic data using any one of the traffic feature extraction methods described in claims 1-3, and training a graph neural network model based on the sample traffic data; The node feature information is converted into graph-level feature information of the traffic interaction topology; Based on a pre-set classification algorithm, the graph-level feature information is classified to determine whether the network traffic to be detected is malicious traffic.
5. A flow characteristic extraction device, characterized in that, The device includes: The first acquisition module is used to acquire network traffic data packets during the session, wherein the network traffic data packets include at least client traffic data packets and server traffic data packets; The first determining module is used to determine a feature vector sequence corresponding to the network traffic data packet based on the network traffic data packet, wherein the feature vector sequence includes a client feature vector sequence and a server feature vector sequence; The second determining module is used to determine the client traffic topology map corresponding to the client feature vector sequence based on the client feature vector sequence. The third determining module is used to determine the server-side traffic topology map corresponding to the server-side feature vector sequence based on the server-side feature vector sequence. A module is established to determine the traffic interaction topology model corresponding to the network traffic data packet based on the client traffic topology map, the server traffic topology map, and the data packet interaction information between the client and the server. The identification module is used to determine the traffic characteristics corresponding to the network traffic data packets based on the traffic interaction topology model. Wherein: the second determining module is used for: Each of the client traffic data packets is identified as a first topology graph node; The client feature vector sequence is determined as the node attribute of the first topology graph node; The data packets transmitted in the same direction within a preset time period by the client traffic data packets are determined to be the first cluster set; Based on the first cluster set, determine the first set of connecting edges; The client traffic topology is determined based on the first topology graph node, the node attributes of the first topology graph node, and the first set of connecting edges; The third determining module is used for: Each of the server-side traffic data packets is identified as a node in the second topology graph. The server-side feature vector sequence is determined as the node attribute of the second topology graph node; The data packets transmitted in the same direction within a preset time period on the server-side traffic data packets are identified as the second cluster set; Based on the second cluster set, determine the second set of connecting edges; The server-side traffic topology is determined based on the second topology graph node, the node attributes of the second topology graph node, and the second set of connecting edges.
6. A malicious traffic detection device, characterized in that, The device includes: The second acquisition module is used to acquire the network traffic to be detected; The detection module is used to determine the node feature information corresponding to the network traffic to be detected based on the network traffic to be detected and a pre-trained node feature extraction model; wherein, the pre-trained node feature extraction model is obtained by acquiring sample traffic data using any one of the traffic feature extraction methods described in claims 1-3, and training a graph neural network model based on the sample traffic data; The conversion module is used to convert the node feature information into graph-level feature information of the traffic interaction topology; The classification module is used to classify the graph-level feature information according to a pre-set classification algorithm and determine whether the network traffic to be detected is malicious traffic.
7. An electronic device, characterized in that, The device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it can implement the traffic feature extraction method according to any one of claims 1-3 or the malicious traffic detection method according to claim 4.
8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, characterized in that, when the program is executed by a processor, it can implement the traffic feature extraction method according to any one of claims 1-3 or the malicious traffic detection method according to claim 4.