A network feature fusion representation and extraction method, device and equipment

Abstract

This application provides a method, apparatus, and device for network feature fusion representation and extraction. The method includes: acquiring network feature data, which includes at least device feature data, topology feature data, and traffic feature data; encoding the network feature data and converting it into structured data; and fusing the structured data to obtain a network feature fusion representation. This application characterizes the network from three different perspectives: device features, topology features, and traffic features, encompassing both static and dynamic characteristics. Furthermore, structured data can carry various forms of device feature data, topology feature data, and traffic feature data, making the fusion feature representation more comprehensive. Therefore, the network fusion feature representation can comprehensively describe a network and uniquely identify it.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method, apparatus and device for network feature fusion representation and extraction. Background Technology

[0002] A network contains a large number of network devices and communication links. Communication links and forwarding nodes (i.e., network devices) constitute the network topology, and traffic also exists in network devices and communication links.

[0003] Currently, most industry-standard network descriptions focus on a single perspective, such as device description, topology description, or traffic description. However, a single perspective cannot capture the full picture of a network. Furthermore, related technologies, when fusing network features, only classify and aggregate some features without actually fusing them. Therefore, they cannot avoid the problem of a large number of feature vectors, meaning they cannot provide a comprehensive description of the network using a limited number of features.

[0004] Therefore, how to comprehensively describe the characteristics of a network is a technical problem that urgently needs to be solved. Summary of the Invention

[0005] In view of the above problems, embodiments of this application provide a method, apparatus and device for network feature fusion representation and extraction, so as to overcome the above problems or at least partially solve the above problems.

[0006] A first aspect of this application discloses a method for network feature extraction and fusion representation, the method comprising:

[0007] Obtain network characteristic data, which includes at least: device characteristic data, topology characteristic data, and traffic characteristic data;

[0008] The network feature data is encoded and converted into structured data;

[0009] The structured data is fused to obtain a fused representation of network features.

[0010] Optionally, the structured data includes a network node graph and a network edge graph, wherein, in terms of topological relationships, the edges in the network node graph are the nodes in the network edge graph; the structured data is fused to obtain a network feature fusion representation, including:

[0011] By using a pre-trained cross-aggregation network, the network node graph and the network edge graph are iteratively aggregated and updated to obtain a network fusion feature representation.

[0012] Optionally, the cross-aggregation network includes an encoder, which includes M cross-aggregation modules. The M cross-aggregation modules correspond to M iterations of aggregation and update. Each cross-aggregation module includes a first sub-module and a second sub-module. The first sub-module and the second sub-module communicate with each other through the node representation of the network edge graph output by the second sub-module.

[0013] Using a pre-trained cross-aggregation network, the network node graph and the network edge graph are iteratively aggregated and updated to obtain a network fusion feature representation, including:

[0014] For each iteration of aggregation and update, the second submodule aggregates the network feature data in the network edge graph to obtain the node representation of the aggregated network edge graph, and inputs the node representation of the aggregated network edge graph into the first submodule;

[0015] The first submodule aggregates the network feature data in the network node graph based on the node representation of the aggregated network edge graph to obtain the node representation of the aggregated network node graph.

[0016] The node feature data in the network edge graph is updated using the node representation of the aggregated network node graph, and the updated network node graph and the updated network edge graph are used for the next iteration of aggregation and update.

[0017] After completing M iterations of aggregation and update, the network fusion feature representation is obtained based on the node representations of the network node graph and the network edge graph obtained from the Mth iteration of aggregation and update.

[0018] Optionally, the second submodule aggregates the network feature data in the network edge graph to obtain the node representation of the aggregated network edge graph, including:

[0019] Based on the aggregation function of the edge graph, the node representation, the adjacent node representation, and the adjacent edge representation of the network edge graph are aggregated to obtain the node representation of the aggregated network edge graph.

[0020] Optionally, the first submodule aggregates the network feature data in the network node graph based on the node representation of the aggregated network edge graph to obtain the node representation of the aggregated network node graph, including:

[0021] Based on the aggregation function of the node graph, the node representations of the aggregated network edge graph, the node representations of the network node graph, and the neighboring node representations of the network node graph are aggregated to obtain the node representations of the aggregated network node graph.

[0022] Optionally, the cross-aggregation network further includes a decoder, which is trained according to the following steps:

[0023] Construct a network dataset;

[0024] Each sample in the network dataset is sequentially input into the encoder of the cross-aggregation network for iterative aggregation and updating to obtain the network fusion feature representation corresponding to the sample;

[0025] The network fusion feature representation corresponding to the sample is decoded using a decoder to obtain decoded features, which include at least: decoded node features, decoded edge features, and decoded network node graph adjacency matrix;

[0026] Calculate the cross-entropy between the decoded features and the original network features as the loss function value;

[0027] The network parameters of the cross-aggregation network are updated according to the loss function. After the training termination condition is met, the trained cross-aggregation network is obtained.

[0028] Optionally, encoding the network feature data and converting it into a network node graph includes:

[0029] The adjacency matrix of the network node graph in the topological feature data is used to represent the node connection relationship of the network node graph;

[0030] The node attribute matrix in the device feature data is used as the node feature of the network node graph. The node attribute matrix is ​​obtained by encoding the device feature field of the network. The device feature field includes at least device type, operating system, installation service, and device IP.

[0031] At least the flow rate link flow matrix, average packet size link flow matrix, TCP connection number link flow matrix, and UDP connection number link flow matrix in the flow characteristic data are used as edge features of the network node graph.

[0032] Optionally, encoding the network feature data and converting it into a network side graph includes:

[0033] The adjacency matrix of the network edge graph in the topological feature data is used to represent the node connection relationship of the network edge graph;

[0034] At least the flow rate link traffic matrix, average packet size link traffic matrix, TCP connection number link traffic matrix, and UDP connection number link traffic matrix in the traffic feature data shall be used as node features of the network side graph.

[0035] At least the matrix of the number of identical OD pairs between links in the traffic feature data shall be used as the edge feature of the network edge graph.

[0036] A second aspect of this application discloses a network feature fusion representation and extraction apparatus, the apparatus comprising:

[0037] The acquisition module is used to acquire network feature data, which includes at least: device feature data, topology feature data, and traffic feature data;

[0038] The conversion module is used to encode the network feature data and convert it into structured data;

[0039] The fusion module is used to fuse the structured data to obtain a fused representation of network features.

[0040] A third aspect of this application discloses an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the steps of the network feature fusion representation and extraction method as described in the first aspect of this application.

[0041] The embodiments of this application have the following advantages:

[0042] This application proposes a method for network feature fusion representation and extraction. First, network feature data is acquired, including at least device feature data, topology feature data, and traffic feature data. This network feature data is then encoded and converted into structured data. Finally, the structured data is fused to obtain a fused network feature representation. Since the acquired network feature data characterizes the network from at least three different perspectives—device features, topology features, and traffic features—it encompasses both static and dynamic network characteristics. Therefore, the resulting fused network feature representation provides a more comprehensive description of the network. Furthermore, structured data can carry various forms of device feature data, topology feature data, and traffic feature data, making the fused feature representation more complete. Thus, the fused network feature representation can comprehensively describe a network and uniquely identify it. Attached Figure Description

[0043] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 This is a flowchart illustrating the steps of a network feature fusion representation and extraction method provided in an embodiment of this application;

[0045] Figure 2 This is a schematic diagram of a network node graph and a network edge graph provided in an embodiment of this application;

[0046] Figure 3 This is a schematic diagram of the structure of a cross-aggregation network provided in an embodiment of this application;

[0047] Figure 4 This is a schematic diagram of the overall process of a network feature fusion representation and extraction method provided in an embodiment of this application;

[0048] Figure 5 This is a schematic diagram of the structure of a network feature fusion representation and extraction device provided in an embodiment of this application. Detailed Implementation

[0049] To make the above-mentioned objectives, features, and advantages of this application more apparent and understandable, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0050] This application provides a method for network feature fusion representation and extraction, such as... Figure 1 As shown, Figure 1 A flowchart of a network feature fusion representation and extraction method provided in this application embodiment includes steps S110 to S130:

[0051] Step S110: Obtain network feature data, which includes at least: device feature data, topology feature data, and traffic feature data.

[0052] In this embodiment, the network characteristic data refers to the network characteristic data of the target network over N (N≥1) consecutive time slots. For example, N=10, with 5 seconds per time slot. Specifically, the device characteristic data includes a node attribute matrix, the topology characteristic data includes a network node graph adjacency matrix and a network edge graph adjacency matrix, and the traffic characteristic data includes a routing matrix and the following matrixes within the N time slots: flow rate link traffic matrix, average packet size link traffic matrix, TCP (Transmission Control Protocol) connection number link traffic matrix, UDP (User Datagram Protocol) connection number link traffic matrix, and the number matrix of identical Origin and Destination Pairs (OD pairs) between links. Here, an OD pair refers to a source node and destination node pair; the node can be a router, a Point of Presence (PoP), or a link. In this embodiment, the source and destination nodes of the OD pair are routers.

[0053] In practical implementation, network characteristic data is obtained by encoding network characteristics (i.e., device characteristic field data, topology characteristic field data, and traffic characteristic field data). Specifically, by encoding device characteristic field data such as node device type, operating system, installed services, and device IP, a node attribute matrix is ​​obtained. By encoding topology characteristic field data such as the connection relationships between nodes, a network node graph adjacency matrix and a network edge graph adjacency matrix are obtained. By multiplying the flow rate flow matrix, average packet size flow matrix, TCP connection number flow matrix, and UDP connection number flow matrix within N time slots respectively with the routing matrix, flow rate link flow matrix, average packet size link flow matrix, TCP connection number link flow matrix, and UDP connection number link flow matrix within N time slots are obtained. Furthermore, using the routing matrix, the link paths of all OD pairs in the flow matrix are found, resulting in a matrix of the number of identical OD pairs between links.

[0054] Step S120: Encode the network feature data and convert it into structured data.

[0055] In this application, because structured data can better express the relationship between data, network feature data is encoded and transformed into structured data to better carry various forms of device feature data, topology feature data and traffic feature data, making the fused feature representation obtained by subsequent fusion more complete.

[0056] In one optional embodiment, the structured data includes a network node graph and a network edge graph, wherein, in terms of topology, the edges in the network node graph are the nodes in the network edge graph.

[0057] Both network node graphs and network edge graphs are storage formats used to represent network feature data. Considering that network node graphs cannot express the relationships between edges, network edge graphs are used to represent network feature data from different dimensions to better represent it. Edges in the network node graph are treated as nodes in the edge graph, thus clearly representing the relationships between edges. Figure 2 This is a schematic diagram of a network node graph and a network edge graph provided in an embodiment of this application.

[0058] Specifically, encoding and converting the network feature data into a network node graph includes: using the adjacency matrix of the network node graph in the topology feature data to represent the node connection relationships of the network node graph; using the node attribute matrix in the device feature data as the node features of the network node graph, wherein the node attribute matrix is ​​obtained by encoding the network device feature fields, and the device feature fields include at least device type, operating system, installed service, and device IP; and using at least the flow rate link flow matrix, average packet size link flow matrix, TCP connection number link flow matrix, and UDP connection number link flow matrix in the flow feature data as the edge features of the network node graph.

[0059] Encoding and converting the network feature data into a network edge graph includes: using the network edge graph adjacency matrix in the topology feature data to represent the node connection relationships of the network edge graph; using at least the flow rate link flow matrix, average packet size link flow matrix, TCP connection number link flow matrix, and UDP connection number link flow matrix in the flow feature data as node features of the network edge graph; and using at least the matrix of the number of identical OD pairs between links in the flow feature data as edge features of the network edge graph.

[0060] In this embodiment, network node graphs and network edge graphs are used to represent network feature data. These graphs can carry various forms of device feature data, topology feature data, and traffic feature data. Subsequently, iterative aggregation and updates are performed based on these graphs to make the final fused feature representation more complete.

[0061] Step S130: The structured data is fused to obtain a fused representation of network features.

[0062] In this embodiment, since the acquired network feature data characterizes the network from at least three different perspectives—device features, topology features, and traffic features—it encompasses both static and dynamic characteristics of the network. Therefore, the resulting network fusion feature representation more comprehensively describes a network. Furthermore, structured data can carry various forms of device feature data, topology feature data, and traffic feature data, making the fusion feature representation more complete. Thus, the network fusion feature representation can comprehensively describe a network and uniquely identify it.

[0063] In one optional embodiment, fusing the structured data to obtain a network feature fusion representation includes: using a pre-trained cross-aggregation network to iteratively aggregate and update the network node graph and the network edge graph to obtain a network fusion feature representation.

[0064] In this embodiment, the cross-aggregation network differs from traditional graph convolutional neural networks that only consider network nodes. This cross-aggregation network uses information from both the node graph and the edge graph to obtain a network fusion feature representation, which reflects the essence of the network. For example, the network fusion feature representation... It can be represented as:

[0065]

[0066] in, Represents a network node graph. Represents a network edge graph. The encoder represents the cross-aggregation network, and READOUT refers to the process of summarizing or aggregating node-level representations into a representation of the entire graph.

[0067] When the network feature data includes network feature data from multiple consecutive time slots, the cross-aggregation network outputs a fused feature sequence. < >. By The eigenvectors in the matrix are arranged into an N-row matrix. ,use This represents the fusion characteristics of the target network over N consecutive time slots. .

[0068] In summary, this application proposes a network feature fusion representation and extraction method. First, network feature data, including device feature data, topology feature data, and traffic feature data, is acquired. Then, network node graphs and network edge graphs are used to represent the network feature data. In terms of topological relationships, the edges in the network node graph are the nodes in the network edge graph. Finally, a pre-trained cross-aggregation network is used to iteratively aggregate and update the network node graph and network edge graph to obtain a network fusion feature representation. Since the acquired network feature data characterizes the network from three different perspectives—device features, topology features, and traffic features—it possesses both static and dynamic characteristics of the network. Therefore, the final network fusion feature representation can more comprehensively describe a network. Furthermore, unlike traditional graph convolutional neural networks that only consider network nodes, this cross-aggregation network uses information from the cross-aggregation network node graph and network edge graph as a fusion carrier, which can carry various forms of device feature data, topology feature data, and traffic feature data, making the fusion feature representation more complete. Therefore, the network fusion feature representation can comprehensively describe a network and uniquely identify it.

[0069] In one alternative embodiment, such as Figure 3 As shown, the cross-aggregation network includes an encoder, which includes M cross-aggregation modules. The M cross-aggregation modules correspond to M iterations of aggregation and update. Each cross-aggregation module includes a first sub-module and a second sub-module. The first sub-module and the second sub-module communicate with each other through the node representation of the network edge graph output by the second sub-module.

[0070] In this embodiment, the first and second submodules have the same structure, each consisting of a GIN layer, a Layer Norm layer, a Graph Norm layer, and a ReLU activation function. One cross-aggregation module in the encoder corresponds to one iteration of aggregation and update, and the number M of cross-aggregation modules in the encoder is set according to the actual situation. In specific implementation, the cross-aggregation modules (i.e., the first and second submodules) iteratively learn the network node representation vectors and network edge representation vectors under two types of graph data: network node graph and network edge graph. During the iteration process, the network edge representation vectors are used as cross-aggregation terms, acting as a bridge for communication between the first and second submodules.

[0071] Furthermore, using a pre-trained cross-aggregation network, the network node graph and the network edge graph are iteratively aggregated and updated to obtain the network fusion feature representation, including steps A1 to A4:

[0072] Step A1: For each iteration of aggregation and update, the second submodule aggregates the network feature data in the network edge graph to obtain the node representation of the aggregated network edge graph, and inputs the node representation of the aggregated network edge graph into the first submodule.

[0073] Specifically, based on the aggregation function of the node graph, the node representations of the aggregated network edge graph, the node representations of the network node graph, and the neighboring node representations of the network node graph are aggregated to obtain the node representations of the aggregated network node graph.

[0074] For example, for the i-th iteration of aggregation and update (M≥i≥1), node and edge The representation of is respectively used and Indicate, then and ＝ This represents the initial features of nodes and edges in the node graph. Therefore, in the i-th iteration, aggregation and updating yield the node representation of the aggregated network node graph. Specifically, it is expressed as follows:

[0075]

[0076] in, It is a node The set of neighboring nodes, It is a node The set of neighboring nodes, yes The set of adjacent edges, Elements in the matrix representing the number of identical OD pairs can be found through links. and Use the sequence number as the index; It is an aggregation function for edge graphs. This represents the nodes of the network edge graph. This represents the adjacent nodes in the network edge graph. In this way, nodes from... The information of adjacent edges and corresponding edge graph nodes is aggregated into Then, in subsequent steps, the node representations of the aggregated network node graph are used to update the node feature data in the network edge graph.

[0077] The aggregation function of the edge graph is used to aggregate information, combining neighbor node features and edge features. The aggregation function of the edge graph can be expressed as:

[0078]

[0079] In this embodiment of the application, since the edges in the network node graph are the nodes in the network edge graph in terms of topological relationship, after obtaining the node representation of the aggregated network node graph, the node representation of the aggregated network edge graph is input into the first submodule as edge feature data of the network node graph, so as to aggregate the network feature data in the network node graph.

[0080] Step A2: The first submodule aggregates the network feature data in the network node graph based on the node representation of the aggregated network edge graph to obtain the node representation of the aggregated network node graph.

[0081] Specifically, based on the aggregation function of the node graph, the node representations of the aggregated network edge graph, the node representations of the network node graph, and the neighboring node representations of the network node graph are aggregated to obtain the node representations of the aggregated network node graph.

[0082] For example, given a node In its first The node representation of the aggregated network node graph obtained during each iteration of aggregation and update. Represented as:

[0083]

[0084] in ， It is a node The set of neighboring nodes, It is an aggregation function for the node graph. This represents the nodes of a network node graph. This represents the adjacent nodes in the network node graph. The node representation of the aggregated network edge graph (i.e., in step A1) For nodes The node representation of the aggregated network node graph From The edge representation vector is obtained by aggregating the representation vectors of the neighboring nodes and the corresponding edge representation vectors. This edge representation vector is learned from the network edge graph. In subsequent steps, the node feature data in the network node graph is updated using the node representation of the aggregated network node graph.

[0085] The aggregation function of the node graph is used to aggregate information, combining neighbor node features and edge features. The aggregation function of the node graph can be expressed as:

[0086]

[0087] Step A3: Update the node feature data in the network edge graph using the node representation of the aggregated network edge graph, and update the node feature data in the network node graph using the node representation of the aggregated network node graph. The updated network node graph and the updated network edge graph are used for the next iteration of aggregation and update.

[0088] Specifically, the node feature data in the network edge graph is updated using the edge graph update function and the node representations of the aggregated network edge graph obtained in step A1. At the i-th iteration, the updated node representations in the network edge graph... It should be:

[0089]

[0090] in, This represents the nodes of the network edge graph. This is the node representation of the aggregated network node graph. This is the update function for the edge graph. The edge graph update function is a two-layer multilayer perceptron (MLP) with a hidden layer size of 64 dimensions, used to update information. The edge graph update function can be represented as:

[0091]

[0092] Specifically, the node feature data in the network node graph is updated using the node graph update function and the node representation of the aggregated network node graph obtained in step S130-2. In the i-th iteration, the updated node representation in the network edge node graph... It should be:

[0093]

[0094] in, This represents the nodes of a network node graph. The node representation of the aggregated network node graph. This is the update function of the node graph. The aggregation function of the node graph is used to aggregate information, aggregating the features of neighboring nodes and edge features. The aggregation function of the node graph can be expressed as:

[0095]

[0096] Step A4: After completing M iterations of aggregation and update, obtain the network fusion feature representation based on the node representation of the network node graph and the node representation of the network edge graph obtained from the Mth iteration of aggregation and update.

[0097] In this embodiment, each iteration of aggregation and update includes a node representation aggregation process and a node representation update process. Steps A1 and A2 respectively aggregate the node representations of the network edge graph and the network node graph to obtain aggregated network edge graph node representations and aggregated network node graph node representations. The updated network edge graph and network node graph are obtained according to the node representation process in step A3. Thus, one iteration of aggregation and update is completed through steps A1 to A3. After all M cross-aggregation modules in the encoder have completed processing (i.e., completed M iterations of aggregation and update), the network fusion feature representation is obtained.

[0098] In one alternative embodiment, such as Figure 3 As shown, the cross-aggregation network also includes a decoder, which consists of multiple MLPs. During training, the decoder decodes the network node representation vectors and network edge representation vectors into node features, edge features, and the adjacency matrix of the original node graph. If the encoder of the cross-aggregation network outputs nodes... The representations are respectively and The decoding task can then be represented as:

[0099]

[0100]

[0101]

[0102] in, The task is to predict whether an edge exists between two points. For decoding Nodes are represented as original The task of node feature analysis For decoding Nodes are represented as original The task of edge features.

[0103] Therefore, the loss function of the decoder is defined as:

[0104]

[0105] in, This represents the decoding results of various decoding tasks. Indicates the original feature, This represents the features after decoding.

[0106] Specifically, the cross-aggregation network is trained according to steps B1 to B5:

[0107] Step B1: Construct the network dataset.

[0108] Step B2: Input each sample in the network dataset into the encoder of the cross-aggregation network in sequence for iterative aggregation and updating to obtain the network fusion feature representation corresponding to the sample.

[0109] Step B3: Use a decoder to decode the network fusion feature representation corresponding to the sample to obtain decoded features. The decoded features include at least: decoded node features, decoded edge features, and decoded network node graph adjacency matrix.

[0110] Step B4: Calculate the cross-entropy between the decoded features and the true features as the loss function value.

[0111] Step B5: Update the network parameters of the cross-aggregation network according to the loss function. After the training termination condition is met, the trained cross-aggregation network is obtained.

[0112] In this embodiment, constructing the network dataset includes: 1) randomly generating the number of network segments and the number of hosts in each segment of the target network to obtain a new network node graph adjacency matrix and a network edge graph adjacency matrix; 2) randomly generating the operating system and installed services of each host in each network segment within the range of commonly used operating systems and installed services to obtain a new node attribute matrix; 3) randomly generating an OD pair traffic matrix and a routing matrix based on the new network topology adjacency matrix, and multiplying the two to obtain a new link average load traffic matrix; 4) randomly generating an OD pair traffic matrix and a routing matrix, multiplying the two to obtain a new link traffic matrix, and finding the link paths of all OD pairs in the traffic matrix through the routing matrix to obtain a new matrix of the number of identical OD pairs between links; 5) packaging the new network node graph adjacency matrix, the network edge graph adjacency matrix, the new node attribute matrix, the new link traffic matrix, and the new matrix of the number of identical OD pairs between links into a single folder as one piece of network data in the network dataset. By repeating the above 5 steps, a network dataset is obtained after meeting the data volume requirements. Furthermore, the network dataset is divided into a network training set and a network validation set in an 8:2 ratio.

[0113] During training, the learning rate of the cross-aggregation network was set to 0.001, the dropout ratio to 0.2, and the dimension of the node and edge representation vectors output by the encoder to 32. The activation function was ReLU. The network training set was input into the cross-aggregation network process, and cross-entropy (BCELoss) was used as the loss function during training. The network parameters of the cross-aggregation network were updated during backpropagation. After each training round, the training effect of the cross-aggregation network was verified using a network validation set. Training was stopped when the set maximum number of iterations was reached, resulting in the trained cross-aggregation network.

[0114] In an optional embodiment, before acquiring network feature data, the method further includes feature extraction of the target network to obtain network features, which include: device feature field data, topology feature field data, and traffic feature field data.

[0115] The device characteristic field data includes device type, operating system, installation service, and device IP; the topology characteristic field data includes the connection relationship between devices and the connection relationship between links in the target network; the traffic characteristic field data includes the routing matrix and the flow rate matrix, average packet size matrix, TCP connection number matrix, and UDP connection number matrix within N time slots.

[0116] In practical implementation, to obtain device characteristic field data, scanning tools (such as Nmap, Nessus, Zenmap, Netcat, etc.) are used to perform network scanning on the target network. This involves performing host liveness scanning, port service scanning, and operating system fingerprinting on the hosts in the target network to obtain device characteristic field data such as device type, operating system, installed services, and device IP.

[0117] To obtain topology feature field data, a traceroute-based network topology probing technique is used to probe the target network. Specifically, step 1: Select one node in the target network as the source node and another node as the destination node. The source node sends probe data packets with TTL values ​​of 1, 2, 3, ..., n sequentially to the destination node, where the data packet with a TTL value of n is the one that will eventually reach the destination node. Step 2: Collect timeout information packets from different routers at the source node. Obtain the IP information of each router along the path from the source node to the destination node from the IP header of the timeout information packets, thus obtaining the path from the source node to the destination node. Step 3: Change the destination node to another node in the target network, and repeat steps 1 and 2 to obtain the path from the source node to the other destination node. Finally, repeat steps 1 to 3 until all nodes in the target network except the source node have been traversed as destination nodes, obtaining the paths from the source node to all other nodes in the target network. Then, by fusing the information from all paths, the topology feature field data of the target network is obtained.

[0118] To obtain traffic characteristic field data, 1) link measurement of the target network is performed using SNMP-based link load measurement technology. Specifically, the SNMP monitoring tool is configured to monitor the IP address and OID parameters of the network device to be monitored, and the tool is used to obtain the corresponding interface information of the link; the SNMP monitoring tool (e.g., Net-SNMP, MIB-Browser, etc.) is started to obtain the interface information of the link from the network device to be monitored; the inbound and outbound traffic of the interface is viewed to obtain the link load.

[0119] 2) Use DPDK-based high-speed traffic capture technology to capture traffic on the target network. Specifically, initialize the DPDK runtime environment, including setting up resources such as memory and CPU, and binding the network interface card (NIC) to the DPDK driver; use the API provided by DPDK to create and configure one or more DPDK ports. These ports are associated with the physical network interface card (NIC) and are used for traffic capture and transmission; configure the capture parameters of the DPDK ports to specify the capture conditions and methods, such as setting filtering rules, capture modes (promiscuous mode, unicast mode, etc.), and capture queues; in a loop, continuously receive data packets from the DPDK ports by calling the API provided by DPDK. You can choose to apply some processing logic in the loop, such as parsing data packets and extracting features; process the received data packets, performing analysis, forwarding, or other operations according to the application's needs. You can use the functions and libraries provided by DPDK to accelerate the data packet processing process; when the traffic capture task is complete, you can stop the capture loop by calling the corresponding API, release related resources, and obtain the relevant traffic feature field data.

[0120] In one optional embodiment, a node attribute matrix is ​​obtained by encoding device characteristic fields such as device type, operating system, installation service, and device IP of the nodes. Specifically, the steps include: 1) classifying commonly used device types, operating systems, installation services, and IP network segments in the target network; 2) in the target network, classifying the device type, operating system, installation service, and device IP characteristic fields of each host obtained by scanning according to the classification categories, wherein the device IP categories are different for different network segments, while the device IP categories are the same for the same network segment; 3) encoding the classification results of each host using one-hot encoding to obtain the node attribute matrix.

[0121] In an optional embodiment, the network node graph adjacency matrix and the network edge graph adjacency matrix are obtained by encoding topological feature fields such as the connection relationships between nodes. Specifically, this includes the following steps: 1) Numbering the nodes and edges in the target network, where the maximum node number is... The maximum number of the edges is ;2) Create The matrix and 3) Based on the connection relationships between nodes and the connection relationships between edges, determine the elements in the matrix to obtain the network node graph adjacency matrix and the network edge graph adjacency matrix. The elements in the matrix are 0 or 1. 0 indicates that there is no connection relationship between the nodes or edges represented by the row and column number of the element, and 1 indicates that there is a connection relationship between the nodes represented by the row and column number of the element.

[0122] In an optional embodiment, the traffic matrix is ​​transformed into a link traffic matrix using a routing matrix, and the link paths of all OD pairs in the traffic matrix are found to obtain a matrix of the number of identical OD pairs between links. Specifically, this includes the following steps: 1) Creating... Matrix; 2) Using the routing matrix, find the link paths for all OD pairs in the traffic matrix, and number each link according to the pre-assigned node and edge numbers, with a maximum encoding of . 3) Iterate through the link paths of each OD pair. If a link path of an OD pair contains link x, add the OD pair number to the set corresponding to link x. 4) In all link sets, find the intersection of each pair and use the size of the intersection as the index of the set. Elements in a matrix.

[0123] Figure 4 This is a schematic diagram of the overall process of a network feature fusion representation and extraction method provided in an embodiment of this application. Specifically, it includes: extracting features from the target network to obtain device feature field data, topology feature field data, and traffic feature field data; encoding the device feature field data, topology feature data, and traffic feature data to obtain network feature data; then using a network node graph and a network edge graph to represent the network feature data, where the edges in the network node graph are the nodes in the network edge graph in terms of topological relationships; and finally using a pre-trained cross-aggregation network to iteratively aggregate and update the network node graph and the network edge graph to obtain a network fusion feature representation.

[0124] The cross-aggregation network includes an encoder and a decoder. The trained cross-aggregation network is based on the encoder's iterative aggregation and updating of the network node graph and network edge graph to obtain the network fusion feature representation. The decoder, during training, decodes the network fusion feature representation predicted by the encoder to obtain the decoded features. Then, it calculates the cross-entropy between the decoded features and the true features as the loss function value, and updates the network parameters of the cross-aggregation network through the backpropagation algorithm. After the training termination condition is met, the trained cross-aggregation network is obtained.

[0125] In this embodiment, the acquired network feature data characterizes the network from three different perspectives: device features, topology features, and traffic features. It encompasses both static and dynamic network characteristics, resulting in a more comprehensive network fusion feature representation. Furthermore, unlike traditional graph convolutional neural networks that only consider network nodes, this cross-aggregation network uses information from both the cross-aggregation network node graph and the network edge graph as a fusion carrier. This allows it to carry various forms of device feature data, topology feature data, and traffic feature data, making the fusion feature representation more complete. Therefore, the network fusion feature representation can comprehensively describe a network and uniquely identify it.

[0126] In practical applications, once a network fusion feature representation that reflects the essence of the network is obtained, network simulation can be performed based on the network fusion feature table. Specifically, this includes: restoring the network fusion feature table to obtain the dynamic and static features of the network; and simulating the simulation network corresponding to the target network based on the dynamic and static features.

[0127] Furthermore, since a network fusion feature table can comprehensively describe a network, restoring the network's device characteristics, topology characteristics, and traffic characteristics can be achieved by reconstructing the network's fusion feature table. Simulation can then be performed based on these restored device characteristics, topology characteristics, and traffic characteristics to simulate the target network. This network simulation method can be used for target range construction and network simulation environment generation.

[0128] In an optional embodiment, since the network fusion feature table can comprehensively describe a network, the similarity between two networks can be determined through the network fusion feature table. Specifically, this includes: extracting the network fusion feature tables of the two target networks respectively; and determining the similarity between the two target networks based on the network fusion feature tables of the two target networks.

[0129] In this embodiment, the network feature fusion representation and extraction method described in steps S110 to S130 is used to obtain network fusion feature representations of two target networks. Each network fusion feature representation can comprehensively describe a target network. Then, the similarity between the network fusion feature representations of the two target networks is compared to determine whether they are similar networks. Specifically, in the similarity judgment, two target networks with a similarity greater than a similarity judgment threshold can be identified as similar networks. Network similarity judgment plays a significant role in proactive intelligent defense.

[0130] In one optional embodiment, network intelligent adaptation can be performed based on network fusion feature representation. Honeynets are one of the main means of intelligent proactive network defense. After an attacker enters the honeynet, in order to "extract" as much of the attacker's attack methods as possible, various strategies can be generated based on the attacker's current attack behavior and interests to change the honeynet's device characteristics, topology characteristics, or traffic characteristics. It is easy to change the honeynet to cater to the attacker's attack behavior and interests, but how to choose the most appropriate change strategy and make the changes as undetectable as possible to the attacker is currently lacking a specific technical solution. Therefore, this embodiment provides a network intelligent prevention based on network fusion feature representation. By utilizing network fusion feature representation, the optimal strategy selection can be achieved, that is, while attracting the attacker to continue attacking, choosing the strategy least likely to be detected by the attacker to change the honeynet.

[0131] Intelligent network adaptation based on network fusion feature representation specifically includes steps C1 to C4:

[0132] Step C1: In N+1 time slots, based on the network conditions, analyze and predict the attacker's next attack behavior and attack interests, and generate a network adaptation strategy to entice the attacker to continue attacking based on the prediction results.

[0133] Step C2: Implement the network adaptation strategy on the network features of N time slots and fuse the basic network features after the strategy is to take effect to obtain the network fusion feature of the N+1th time slot of the adaptation strategy.

[0134] Step C3: Use cosine similarity to calculate the similarity between the network fusion feature of the (N+1)th time slot and the network fusion feature of the Nth time slot corresponding to the adaptation strategy.

[0135] Step C4: Determine whether the similarity reaches the specified threshold. If the similarity reaches the specified threshold, the adaptation strategy is evaluated as having good stealth and can maintain the attacker's near-unaware state during the adaptation process. If the similarity does not reach the specified threshold, the adaptation strategy is evaluated as not having good stealth and the adaptation strategy needs to be regenerated.

[0136] In this embodiment, network fusion feature representations characterize the network from three different perspectives: device features, topology features, and traffic features. Then, the similarity between different network fusion feature representations can be compared to measure the degree of similarity between two networks. The similarity comparison of network fusion feature representations can be applied to network intelligent adaptation. Network intelligent prevention based on network fusion feature representations can help filter out network adaptation strategies that are not easily detected by attackers, enabling the network to adapt in a direction that is not easily detected by attackers, while also inducing attackers to launch deeper attacks.

[0137] This application also provides a network feature fusion representation and extraction apparatus, such as... Figure 5 As shown, Figure 5 This is a schematic diagram of a network feature fusion representation and extraction device provided in an embodiment of this application. The device includes:

[0138] The acquisition module 510 is used to acquire network feature data, which includes at least: device feature data, topology feature data and traffic feature data;

[0139] The conversion module 520 is used to encode the network feature data and convert it into structured data;

[0140] The fusion module 530 is used to fuse the structured data to obtain a fused representation of network features.

[0141] In one optional embodiment, the structured data includes a network node graph and a network edge graph, wherein, in terms of topological relationships, the edges in the network node graph are the nodes in the network edge graph; the fusion module includes:

[0142] The iterative module is used to iteratively aggregate and update the network node graph and the network edge graph using a pre-trained cross-aggregation network to obtain a network fusion feature representation.

[0143] In one optional embodiment, the cross-aggregation network includes an encoder, the encoder includes M cross-aggregation modules, the M cross-aggregation modules correspond to M iterations of aggregation and update, the cross-aggregation modules include a first sub-module and a second sub-module, and the first sub-module and the second sub-module communicate with each other through the node representation of the network edge graph output by the second sub-module;

[0144] Using a pre-trained cross-aggregation network, the network node graph and the network edge graph are iteratively aggregated and updated to obtain a network fusion feature representation, including:

[0145] The edge graph aggregation module is used for aggregation and updating for each iteration. The second submodule aggregates the network feature data in the network edge graph to obtain the node representation of the aggregated network edge graph, and inputs the node representation of the aggregated network edge graph into the first submodule.

[0146] The node graph set module is used by the first submodule to aggregate the network feature data in the network node graph according to the node representation of the aggregated network edge graph, so as to obtain the node representation of the aggregated network node graph.

[0147] The update module is used to update the node feature data in the network edge graph using the node representation of the aggregated network edge graph, and to update the node feature data in the network node graph using the node representation of the aggregated network node graph. The updated network node graph and the updated network edge graph are used for the next iteration of aggregation and update.

[0148] The results module is used to obtain the network fusion feature representation based on the node representation of the network node graph and the node representation of the network edge graph obtained after completing M iterations of aggregation and update.

[0149] In one optional embodiment, the second submodule aggregates the network feature data in the network edge graph to obtain the node representation of the aggregated network edge graph, including:

[0150] Based on the aggregation function of the edge graph, the node representation, the adjacent node representation, and the adjacent edge representation of the network edge graph are aggregated to obtain the node representation of the aggregated network edge graph.

[0151] In an optional embodiment, the first submodule aggregates the network feature data in the network node graph based on the node representation of the aggregated network edge graph to obtain the node representation of the aggregated network node graph, including:

[0152] Based on the aggregation function of the node graph, the node representations of the aggregated network edge graph, the node representations of the network node graph, and the neighboring node representations of the network node graph are aggregated to obtain the node representations of the aggregated network node graph.

[0153] In an optional embodiment, the cross-aggregation network further includes a decoder, and the apparatus includes a training module for training the cross-aggregation network, the training module comprising:

[0154] Modules for building network datasets;

[0155] The prediction module is used to sequentially input each sample in the network dataset into the encoder of the cross-aggregation network for iterative aggregation and updating, so as to obtain the network fusion feature representation corresponding to the sample;

[0156] The decoding module is used to decode the network fusion feature representation corresponding to the sample using the decoder to obtain the decoded features, which include at least: decoded node features, decoded edge features, and decoded network node graph adjacency matrix;

[0157] The calculation module is used to calculate the cross-entropy between the decoded features and the real features as the loss function value;

[0158] The network parameter module is used to update the network parameters of the cross-aggregation network according to the loss function, and obtain the trained cross-aggregation network after the training termination condition is met.

[0159] In one optional embodiment, the conversion module includes:

[0160] The first transformation submodule is used to represent the node connection relationship of the network node graph using the network node graph adjacency matrix in the topological feature data;

[0161] The second conversion submodule is used to use the node attribute matrix in the device feature data as the node features of the network node graph. The node attribute matrix is ​​obtained by encoding the device feature fields of the network. The device feature fields include at least device type, operating system, installation service, and device IP.

[0162] The third transformation submodule is used to take at least the flow rate link flow matrix, average packet size link flow matrix, TCP connection number link flow matrix, and UDP connection number link flow matrix from the flow characteristic data as edge features of the network node graph.

[0163] In one optional embodiment, the conversion module includes:

[0164] The fourth transformation submodule is used to represent the node connection relationship of the network edge graph using the network edge graph adjacency matrix in the topological feature data;

[0165] The fifth transformation submodule is used to take at least the flow rate link traffic matrix, average packet size link traffic matrix, TCP connection number link traffic matrix, and UDP connection number link traffic matrix from the traffic feature data as node features of the network side graph.

[0166] The sixth transformation submodule is used to take at least the matrix of the number of identical OD pairs between links in the traffic feature data as the edge features of the network edge graph.

[0167] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the network feature extraction and fusion representation method described in this application.

[0168] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0169] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, apparatuses, devices, and media according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0170] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0171] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0172] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0173] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0174] The foregoing has provided a detailed description of a network feature fusion representation and extraction method, apparatus, and device provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and its core ideas. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for network feature fusion representation and extraction, characterized in that, The method includes: Obtain network characteristic data, which includes at least: device characteristic data, topology characteristic data, and traffic characteristic data; The network feature data is encoded and converted into structured data; The structured data is fused to obtain a fused representation of network features; The structured data includes a network node graph and a network edge graph. In terms of topology, the edges in the network node graph are the nodes in the network edge graph. The structured data is fused to obtain a network feature fusion representation, which includes: using a pre-trained cross-aggregation network to iteratively aggregate and update the network node graph and the network edge graph to obtain a network fusion feature representation. The cross-aggregation network includes an encoder, which comprises M cross-aggregation modules. Each M cross-aggregation module corresponds to M iterations of aggregation and update. Each cross-aggregation module includes a first sub-module and a second sub-module. The first sub-module and the second sub-module communicate through the node representation of the network edge graph output by the second sub-module. Using a pre-trained cross-aggregation network, the network node graph and the network edge graph are iteratively aggregated and updated to obtain a network fusion feature representation, including: For each iteration of aggregation and update, the second submodule aggregates the network feature data in the network edge graph to obtain the node representation of the aggregated network edge graph, and inputs the node representation of the aggregated network edge graph into the first submodule; The first submodule aggregates the network feature data in the network node graph based on the node representation of the aggregated network edge graph to obtain the node representation of the aggregated network node graph. The node feature data in the network edge graph is updated using the node representation of the aggregated network node graph, and the updated network node graph and the updated network edge graph are used for the next iteration of aggregation and update. After completing M iterations of aggregation and update, the network fusion feature representation is obtained based on the node representations of the network node graph and the network edge graph obtained from the Mth iteration of aggregation and update.

2. The method according to claim 1, characterized in that, The second submodule aggregates the network feature data in the network edge graph to obtain the node representation of the aggregated network edge graph, including: Based on the aggregation function of the edge graph, the node representation, the adjacent node representation, and the adjacent edge representation of the network edge graph are aggregated to obtain the node representation of the aggregated network edge graph.

3. The method according to claim 1, characterized in that, The first submodule aggregates the network feature data in the network node graph based on the node representation of the aggregated network edge graph, to obtain the node representation of the aggregated network node graph, including: Based on the aggregation function of the node graph, the node representations of the aggregated network edge graph, the node representations of the network node graph, and the neighboring node representations of the network node graph are aggregated to obtain the node representations of the aggregated network node graph.

4. The method according to claim 1, characterized in that, The cross-aggregation network also includes a decoder, which is trained according to the following steps: Construct a network dataset; Each sample in the network dataset is sequentially input into the encoder of the cross-aggregation network for iterative aggregation and updating to obtain the network fusion feature representation corresponding to the sample; The network fusion feature representation corresponding to the sample is decoded using a decoder to obtain decoded features, which include at least: decoded node features, decoded edge features, and decoded network node graph adjacency matrix; Calculate the cross-entropy between the decoded features and the original network features as the loss function value; The network parameters of the cross-aggregation network are updated according to the loss function. After the training termination condition is met, the trained cross-aggregation network is obtained.

5. The method according to claim 1, characterized in that, Encoding the network feature data and converting it into a network node graph includes: The adjacency matrix of the network node graph in the topological feature data is used to represent the node connection relationship of the network node graph; The node attribute matrix in the device feature data is used as the node feature of the network node graph. The node attribute matrix is ​​obtained by encoding the device feature field of the network. The device feature field includes at least device type, operating system, installation service, and device IP. At least the flow rate link flow matrix, average packet size link flow matrix, TCP connection number link flow matrix, and UDP connection number link flow matrix in the flow characteristic data are used as edge features of the network node graph.

6. The method according to claim 1, characterized in that, Encoding the network feature data and converting it into a network side graph includes: The adjacency matrix of the network edge graph in the topological feature data is used to represent the node connection relationship of the network edge graph; At least the flow rate link traffic matrix, average packet size link traffic matrix, TCP connection number link traffic matrix, and UDP connection number link traffic matrix in the traffic feature data shall be used as node features of the network side graph. At least the matrix of the number of identical OD pairs between links in the traffic feature data shall be used as the edge feature of the network edge graph.

7. A network feature fusion representation and extraction device, characterized in that, The device includes: The acquisition module is used to acquire network feature data, which includes at least: device feature data, topology feature data, and traffic feature data; The conversion module is used to encode the network feature data and convert it into structured data; The fusion module is used to fuse the structured data to obtain a fused representation of network features; The structured data includes a network node graph and a network edge graph. In terms of topology, the edges in the network node graph are the nodes in the network edge graph. The structured data is fused to obtain a network feature fusion representation, which includes: using a pre-trained cross-aggregation network to iteratively aggregate and update the network node graph and the network edge graph to obtain a network fusion feature representation. The cross-aggregation network includes an encoder, which comprises M cross-aggregation modules. Each M cross-aggregation module corresponds to M iterations of aggregation and update. Each cross-aggregation module includes a first sub-module and a second sub-module. The first sub-module and the second sub-module communicate through the node representation of the network edge graph output by the second sub-module. Using a pre-trained cross-aggregation network, the network node graph and the network edge graph are iteratively aggregated and updated to obtain a network fusion feature representation, including: For each iteration of aggregation and update, the second submodule aggregates the network feature data in the network edge graph to obtain the node representation of the aggregated network edge graph, and inputs the node representation of the aggregated network edge graph into the first submodule; The first submodule aggregates the network feature data in the network node graph based on the node representation of the aggregated network edge graph to obtain the node representation of the aggregated network node graph. The node feature data in the network edge graph is updated using the node representation of the aggregated network node graph, and the updated network node graph and the updated network edge graph are used for the next iteration of aggregation and update. After completing M iterations of aggregation and update, the network fusion feature representation is obtained based on the node representations of the network node graph and the network edge graph obtained from the Mth iteration of aggregation and update.

8. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executed, implements the steps of the network feature fusion representation and extraction method as described in any one of claims 1-6.

Images