Intrusion detection method and system based on historical data and GCN

Abstract

The present invention discloses an intrusion detection method and system based on historical data and GCN. The method triggers a GCN mechanism according to multi-view time data and multi-view space data, and defines the interaction relationship between the multi-view time data and the multi-view space data; defines weight information of the multi-view time data and the multi-view space data based on the interaction relationship between the visual attention mechanism and the multi-view time data and the multi-view space data; fuses the weight information, the multi-view time data and the multi-view space data, and outputs the fused information; filters the intrusion detection information based on the fused information, and performs real-time intrusion detection on the data. At this time, the interaction relationship between the multi-view time data and the multi-view space data is fully utilized to facilitate the fusion of the weight information, the multi-view time data and the multi-view space data, and then defines the intrusion detection information, thereby realizing real-time intrusion detection of the data.

Description

Technical Field

[0001] The present invention relates to the technical field of intrusion detection based on historical data and GCN, and in particular to an intrusion detection method and system based on historical data and GCN. Background Art

[0002] With the development of science and technology, the application of digital technology enables the industrial Internet to achieve comprehensive perception and highly intelligent operation, and strengthen the flexible coordination and interconnection between sources, networks, loads, and storage. However, it also brings network security risks to the industrial Internet. In the existing technology, the existing intrusion detection methods mainly include rule-based, sequence-based, and graph matching detection methods. The rule-based detection method mainly summarizes the rules based on malicious behavior, and does not take into account time and space. The existing intrusion detection method cannot guarantee the accuracy of detection. Summary of the invention

[0003] The purpose of the present invention is to overcome the shortcomings of the prior art. The present invention provides an intrusion detection method and system based on historical data and GCN, which are compatible with time and space considerations for intrusion detection, and make full use of the interaction relationship between multi-view time data and multi-view space data, so as to ensure the accuracy of weight information in multiple dimensions, so as to facilitate the fusion of weight information, multi-view time data and multi-view space data, and then define intrusion detection information, realize real-time intrusion detection of data, and ensure the detection accuracy of the intrusion detection method based on historical data and GCN, so as to realize the accurate detection of log and traffic data, and provide personalized and accurate network security services for the industrial Internet.

[0004] In order to solve the above technical problems, an embodiment of the present invention provides an intrusion detection method based on historical data and GCN, which is applied to an intrusion detection scenario based on historical data and GCN; the intrusion detection method based on historical data and GCN includes:

[0005] Acquire historical data and locate multi-view data based on the historical data;

[0006] Determining multi-view temporal data and multi-view spatial data based on the multi-view data;

[0007] The GCN mechanism is triggered according to the multi-view temporal data and the multi-view spatial data, and the interaction relationship between the multi-view temporal data and the multi-view spatial data is defined;

[0008] Based on the interaction relationship between the visual attention mechanism and the multi-view temporal data and the multi-view spatial data, the weight information of the multi-view temporal data and the multi-view spatial data is defined;

[0009] Fusing the weight information, the multi-view temporal data, and the multi-view spatial data, and outputting the fused information;

[0010] Filter intrusion detection information based on fusion information and perform real-time intrusion detection on the data.

[0011] Optionally, the acquiring historical data and locating the multi-view data based on the historical data includes:

[0012] Obtain historical data based on the Industrial Internet;

[0013] Divide historical data into multiple data sets;

[0014] Locating multi-view data based on parsing of multiple data sets;

[0015] For multi-view data, trigger data preprocessing based on multi-view data and locate abnormal data;

[0016] The abnormal nodes and abnormal numbers corresponding to the abnormal data are collected, and the abnormal levels are defined according to the abnormal nodes and abnormal numbers. The optimization of the abnormal data is triggered based on the abnormal level to improve the multi-view data.

[0017] Optionally, determining the multi-view time data and the multi-view spatial data based on the multi-view data includes:

[0018] Freeze multi-view data;

[0019] Label the corresponding attributes based on the multi-view data, and filter the temporal attributes and spatial attributes;

[0020] Determine multi-view time data according to the time attribute and the multi-view data;

[0021] Marking time classes based on multi-view time data and dividing the multi-view time data into different time periods;

[0022] Determine multi-view spatial data according to the spatial attribute and the multi-view data;

[0023] Marking spatial classes based on multi-view spatial data and dividing multi-view spatial data in different spaces;

[0024] Dynamic interaction is performed based on multi-view temporal data of different time periods and multi-view spatial data of different spaces to form a temporal-spatial multi-view data combination, and an overall operation is performed based on the temporal-spatial multi-view data combination.

[0025] Optionally, triggering the GCN mechanism according to the multi-view temporal data and the multi-view spatial data, and defining the functional relationship between the multi-view temporal data and the multi-view spatial data, includes:

[0026] Freeze multi-view temporal data and multi-view spatial data;

[0027] Associating multi-view temporal data and multi-view spatial data;

[0028] The GCN mechanism is triggered based on multi-view temporal data and multi-view spatial data.

[0029] Optionally, triggering the GCN mechanism according to the multi-view time data and the multi-view space data, and defining the action relationship between the multi-view time data and the multi-view space data, further includes:

[0030] In the GCN mechanism, multi-level convolution is performed on multi-view temporal data and multi-view spatial data, and edge transfer is performed on multi-view temporal data and multi-view spatial data during the multi-level convolution process;

[0031] Collect edge weights, and aggregate edge data in the multi-view temporal data and the multi-view spatial data according to the edge weights to form an aggregation result;

[0032] A linear transformation is performed based on the aggregation results and the data node information to define the interaction relationship between the multi-view temporal data and the multi-view spatial data.

[0033] Optionally, the defining weight information of the multi-view time data and the multi-view space data based on the interaction relationship between the visual attention mechanism and the multi-view time data and the multi-view space data includes:

[0034] Freeze the interaction between multi-view temporal data and multi-view spatial data;

[0035] Relate visual attention mechanisms and their role;

[0036] The interaction relationship is controlled according to the visual attention mechanism, and the multi-view temporal data and the multi-view spatial data are optimized based on the visual attention mechanism to define the weight information of the multi-view temporal data and the multi-view spatial data.

[0037] Optionally, fusing the weight information, the multi-view time data, and the multi-view space data, and outputting the fused information, includes:

[0038] Collect corresponding weights, multi-view temporal data, and multi-view spatial data;

[0039] Freeze the current node of the Industrial Internet and define the data detection level based on the current node of the Industrial Internet.

[0040] Optionally, the fusing according to the weight information, the multi-view time data and the multi-view space data, and outputting the fused information, further includes:

[0041] Perform preliminary detection on the multi-view temporal data and the multi-view spatial data based on the data detection level, and output preliminary detection information;

[0042] Defining a data fusion level based on preliminary detection information and weight information;

[0043] According to the data fusion level, multi-view time data and multi-view spatial data are fused and the fusion information is output.

[0044] Optionally, the filtering of intrusion detection information based on fusion information and performing real-time intrusion detection on the data includes:

[0045] Freeze-frame fusion information;

[0046] Divide multiple information segments based on the fusion information, and filter the intrusion detection information according to the traversal of the multiple information segments;

[0047] Mark the intrusion path and intrusion level according to the intrusion detection information;

[0048] Defining invasion combinations based on the matching of invasion pathways and invasion levels;

[0049] Perform real-time intrusion detection on data based on intrusion combinations, perform real-time intrusion detection on data in different dimensions, and evaluate the intrusion impact of data on the Industrial Internet in different dimensions.

[0050] Optionally, an intrusion detection system based on historical data and GCN is applied to the above-mentioned intrusion detection method based on historical data and GCN, and the intrusion detection system based on historical data and GCN includes:

[0051] An acquisition module, used to acquire historical data and locate multi-view data based on the historical data;

[0052] A data module, configured to determine multi-view time data and multi-view spatial data based on the multi-view data;

[0053] The action relationship module is used to trigger the GCN mechanism according to the multi-view temporal data and the multi-view spatial data, and define the action relationship between the multi-view temporal data and the multi-view spatial data;

[0054] A weight module, used to define weight information of the multi-view time data and the multi-view space data based on the interaction relationship between the visual attention mechanism and the multi-view time data and the multi-view space data;

[0055] A fusion information module, used for fusing the weight information, the multi-view temporal data and the multi-view spatial data, and outputting the fusion information;

[0056] The detection module is used to filter intrusion detection information based on fusion information and perform real-time intrusion detection on the data.

[0057] In an embodiment of the present invention, through the method in the embodiment of the present invention, historical data is obtained, and multi-view data is located based on the historical data; multi-view time data and multi-view spatial data are determined based on the multi-view data; the GCN mechanism is triggered according to the multi-view time data and the multi-view spatial data, and the interaction relationship between the multi-view time data and the multi-view spatial data is defined; based on the interaction relationship between the visual attention mechanism and the multi-view time data and the multi-view spatial data, the weight information of the multi-view time data and the multi-view spatial data is defined; according to the weight information, the multi-view time data and the multi-view spatial data, fusion is performed, and the fusion information is output; based on the fusion information, the intrusion detection information is filtered, and real-time intrusion detection is performed on the data. At this time, the intrusion detection is compatible with the consideration of time and space, and the interaction relationship between the multi-view time data and the multi-view spatial data is fully utilized, so as to ensure the accuracy of the weight information in multiple dimensions, so as to fuse the weight information, the multi-view time data and the multi-view spatial data, and then define the intrusion detection information, realize the real-time intrusion detection of the data, and ensure the detection accuracy of the intrusion detection method based on historical data and GCN, so as to realize the accurate detection of log and traffic data, and provide personalized and accurate network security services for the industrial Internet. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0059] Figure 1 is a flowchart of an intrusion detection method based on historical data and GCN in an embodiment of the present invention;

[0060] Figure 2 is a flow chart of S11 in the intrusion detection method based on historical data and GCN in an embodiment of the present invention;

[0061] Figure 3 is a flow chart of S12 in the intrusion detection method based on historical data and GCN in an embodiment of the present invention;

[0062] Figure 4 is a flow chart of S13 in the intrusion detection method based on historical data and GCN in an embodiment of the present invention;

[0063] Figure 5 is a flow chart of S14 in the intrusion detection method based on historical data and GCN in an embodiment of the present invention;

[0064] Figure 6 is a flow chart of S15 in the intrusion detection method based on historical data and GCN in an embodiment of the present invention;

[0065] Figure 7 is a flow chart of S16 in the intrusion detection method based on historical data and GCN in an embodiment of the present invention;

[0066] Figure 8 Schematic diagram of the structure of an intrusion detection system based on historical data and GCN in an embodiment of the present invention;

[0067] Fig. 9 The figure is a hardware diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0068] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0069] See also Figures 1 to 9 , an intrusion detection method based on historical data and GCN, applied to an intrusion detection scenario based on historical data and GCN; the intrusion detection method based on historical data and GCN includes:

[0070] Step S11: acquiring historical data, and locating multi-view data based on the historical data;

[0071] Step S12: determining multi-view time data and multi-view spatial data based on the multi-view data;

[0072] Step S13: triggering the GCN mechanism according to the multi-view temporal data and the multi-view spatial data, and defining the functional relationship between the multi-view temporal data and the multi-view spatial data;

[0073] Step S14: defining weight information of the multi-view time data and the multi-view space data based on the interaction relationship between the visual attention mechanism and the multi-view time data and the multi-view space data;

[0074] Step S15: fusing the multi-view temporal data and the multi-view spatial data according to the weight information, and outputting the fused information;

[0075] Step S16: Filter the intrusion detection information based on the fusion information, and perform real-time intrusion detection on the data.

[0076] In the embodiment of the present invention, through the method in the embodiment of the present invention, time and space considerations are compatible for intrusion detection, and the interaction relationship between multi-view time data and multi-view space data is fully utilized, so as to ensure the accuracy of weight information in multiple dimensions, so as to facilitate the fusion of weight information, multi-view time data and multi-view space data, and then define intrusion detection information, realize real-time intrusion detection of data, and ensure the detection accuracy of the intrusion detection method based on historical data and GCN, so as to realize the accurate detection of log and traffic data, and provide personalized and accurate network security services for the industrial Internet.

[0077] See also Figure 2 , in step S11, historical data is obtained, and multi-view data is located based on the historical data;

[0078] In the specific implementation process of the present invention, the specific steps may be:

[0079] S111: Obtain historical data based on the Industrial Internet;

[0080] S112: Divide the historical data into multiple data sets;

[0081] S113: locating multi-view data based on parsing of multiple data sets;

[0082] S114: triggering data preprocessing based on the multi-view data and locating abnormal data;

[0083] S115: Collect abnormal nodes and abnormal numbers corresponding to abnormal data, define abnormal levels according to the abnormal nodes and abnormal numbers, and trigger optimization of abnormal data based on the abnormal levels to improve multi-view data.

[0084] In an embodiment of the present application, historical data is acquired based on the industrial Internet and is further managed and controlled. At this time, the historical data is divided into multiple data sets so that the multi-view data can be located based on the analysis of the multiple data sets, thereby freezing the multi-view data, so as to further troubleshoot the multi-view data and control the accuracy of the multi-view data.

[0085] Optionally, multiple data sets are located to trigger set parsing for the multiple data sets, to facilitate traversal of the data sets from the perspective of each data set, thereby locating each data during the traversal of the data sets, and collecting the presentation form of each data, so as to locate multi-view data under the parsing of the presentation form of each data.

[0086] At this time, for the multi-view data, data preprocessing is triggered based on the multi-view data, and abnormal data is located; the abnormal nodes and abnormal numbers corresponding to the abnormal data are collected, and the abnormal level is defined according to the abnormal nodes and abnormal numbers, and the optimization of the abnormal data is triggered based on the abnormal level to improve the multi-view data, so as to control the abnormalities of the multi-view data, so as to facilitate the collection of abnormal data, so as to consider the abnormal nodes and abnormal numbers in the abnormal data, and then ensure the abnormal level of the abnormal data, so as to trigger the optimization of the abnormal data based on the abnormal level.

[0087] Furthermore, data preprocessing is performed on the multi-view data to facilitate abnormality detection of the multi-view data, thereby defining abnormal data of the multi-view data in the abnormality detection to facilitate marking the location of the abnormal data, and then triggering the location of the abnormal data according to the location of the abnormal data, thereby clarifying the abnormal data.

[0088] In addition, the abnormality level is fixed so as to match the abnormality optimization table according to the abnormality level, and the optimization means is determined according to the mapping relationship of the abnormality optimization table and the abnormality level, so as to optimize the abnormal data according to the optimization means, thereby improving the multi-view data.

[0089] See also Figure 3 , in step S12, determining multi-view time data and multi-view spatial data based on the multi-view data;

[0090] In the specific implementation process of the present invention, the specific steps may be:

[0091] S121: freeze multi-view data;

[0092] S122: marking corresponding attributes based on the multi-view data, and filtering time attributes and space attributes;

[0093] S123: Determine multi-view time data according to the time attribute and the multi-view data;

[0094] S124: marking time classes based on the multi-view time data, and dividing the multi-view time data into different time periods;

[0095] S125: Determine multi-view spatial data according to the spatial attribute and the multi-view data;

[0096] S126: marking the spatial class based on the multi-view spatial data, and dividing the multi-view spatial data into different spaces;

[0097] S127: Dynamically interacting the multi-view temporal data of different time periods and the multi-view spatial data of different spaces to form a temporal-spatial multi-view data combination, and performing an integrated operation based on the temporal-spatial multi-view data combination.

[0098] In an embodiment of the present application, multi-view data is frozen so as to mark the multi-view data, thereby marking corresponding attributes based on the multi-view data, and filtering time attributes and space attributes, so as to introduce time attributes and space attributes, and then control the time attributes and space attributes, and fully consider the time factor and the attribute factor.

[0099] At this time, the multi-view time data is determined according to the time attributes and the multi-view data, so as to control the multi-view time data. At the same time, the multi-view time data is determined according to the time attributes and the multi-view data; the time class is marked based on the multi-view time data, and the multi-view time data of different time periods are divided, so as to control the different time periods.

[0100] For multi-view temporal data, multiple temporal dependencies mainly include trend and periodicity, which reflect recent trends and periodic influences respectively. In order to describe multiple temporal dependencies from different perspectives, we consider multi-view temporal data of different granularities. In addition to conventional session data, we also consider time series data with time window partitioning and neighborhood partitioning.

[0101] In addition, multi-view spatial data is determined according to spatial attributes and multi-view data; spatial classes are marked based on the multi-view spatial data, and multi-view spatial data of different spaces are divided, so as to perform control based on the multi-view spatial data of different spaces.

[0102] For multi-view spatial data, we use graph Represents a complex data network. For each graph , is the vertex set used to represent data, is an edge set, is the adjacency matrix, Indicates data transmission and The edge weight between.

[0103] At this time, multi-view temporal data based on different time periods and multi-view spatial data in different spaces dynamically interact to form a time-space multi-view data combination, and perform overall operations based on the time-space multi-view data combination, thereby being compatible with time-space processing, so as to facilitate overall control based on the multi-view data group.

[0104] Optionally, time factors and space factors are introduced, and multi-view data combinations are constructed for the time factors and space factors to facilitate combined presentation. At the same time, the multi-view data combination is used as an operation object, and the multi-view data combination is input into a corresponding learning model to realize the overall operation of the multi-view data combination and output the corresponding overall operation result.

[0105] See also Figure 4 In step S13, the GCN mechanism is triggered according to the multi-view temporal data and the multi-view spatial data, and the functional relationship between the multi-view temporal data and the multi-view spatial data is defined;

[0106] In the specific implementation process of the present invention, the specific steps may be:

[0107] S131: Freeze the multi-view temporal data and the multi-view spatial data;

[0108] S132: Associating multi-view temporal data and multi-view spatial data;

[0109] S133: triggering a GCN mechanism based on multi-view temporal data and multi-view spatial data;

[0110] S134: In the GCN mechanism, multi-level convolution is performed on the multi-view temporal data and the multi-view spatial data, and edge transfer is performed on the multi-view temporal data and the multi-view spatial data during the multi-level convolution process;

[0111] S135: collecting edge weights, and aggregating edge data in the multi-view temporal data and the multi-view spatial data according to the edge weights to form an aggregation result;

[0112] S136: Perform linear transformation according to the aggregation result and the data node information to define the interaction relationship between the multi-view temporal data and the multi-view spatial data.

[0113] In an embodiment of the present application, the multi-view time data and the multi-view space data are frozen; S132: the multi-view time data and the multi-view space data are associated to facilitate the control of the multi-view time data and the multi-view space data, and to be compatible with the overall operation of time and space.

[0114] At this time, the GCN mechanism is triggered based on the multi-view temporal data and the multi-view spatial data. In the GCN mechanism, multi-level convolutions are performed on the multi-view temporal data and the multi-view spatial data, and the multi-view temporal data and the multi-view spatial data are edge-transferred during the multi-level convolution process. Optionally, the GCN mechanism is a graph convolutional network mechanism, which performs convolution-based operations on the multi-view temporal data and the multi-view spatial data to facilitate the control of the multi-view temporal data and the multi-view spatial data.

[0115] At the same time, edge weights are collected, and aggregation is performed based on the edge weights and the edge data in the multi-view time data and the multi-view space data to form an aggregation result; linear transformation is performed based on the aggregation result and the data node information to define the interaction relationship between the multi-view time data and the multi-view space data.

[0116] Optionally, multi-view temporal data and multi-view spatial data are introduced, and the multi-view temporal data and multi-view spatial data are managed, so as to define trigger factors based on the multi-view temporal data and multi-view spatial data, and trigger the GCN mechanism according to the trigger factors, thereby introducing the GCN mechanism, so as to manage the multi-view temporal data and multi-view spatial data according to the GCN mechanism.

[0117] With regard to the interaction relationship between multi-view temporal data and multi-view spatial data, linear transformation is performed based on aggregation results and data node information to form a transformation result, and the interaction relationship is defined according to the transformation result and the interaction relationship matching table, thereby clarifying the interaction relationship between multi-view temporal data and multi-view spatial data.

[0118] See also Figure 5 , S14: defining weight information of the multi-view time data and the multi-view space data based on the interaction relationship between the visual attention mechanism and the multi-view time data and the multi-view space data;

[0119] In the specific implementation process of the present invention, the specific steps may be:

[0120] S141: freeze the interaction relationship between the multi-view temporal data and the multi-view spatial data;

[0121] S142: Relationship between visual attention mechanisms and their effects;

[0122] S143: Controlling the interaction relationship according to the visual attention mechanism, and optimizing the multi-view temporal data and the multi-view spatial data based on the visual attention mechanism to define weight information of the multi-view temporal data and the multi-view spatial data.

[0123] In an embodiment of the present application, the interaction relationship between multi-view temporal data and multi-view spatial data is frozen to facilitate further control of the interaction relationship. At this time, the visual attention mechanism is associated with the interaction relationship; the interaction relationship is controlled according to the visual attention mechanism, and the multi-view temporal data and multi-view spatial data are optimized based on the visual attention mechanism to define weight information of the multi-view temporal data and the multi-view spatial data.

[0124] At this time, intrusion detection is compatible with time and space considerations, and makes full use of the interaction relationship between multi-view time data and multi-view spatial data, so as to ensure the accuracy of weight information in multiple dimensions, so as to integrate weight information, multi-view time data and multi-view spatial data, and then define intrusion detection information, realize real-time intrusion detection of data, and ensure the detection accuracy of intrusion detection methods based on historical data and GCN, so as to realize accurate detection of log and traffic data, and provide personalized and accurate network security services for the industrial Internet.

[0125] Optionally, a visual attention mechanism is introduced, and the multi-view time data and the multi-view space data are managed and controlled according to the visual attention mechanism, so as to further define the interaction relationship between the multi-view time data and the multi-view space data, so as to analyze the interaction relationship, so as to restrict the interaction relationship, thereby ensuring the accuracy of the interaction relationship, so as to further define the weight information of the multi-view time data and the multi-view space data according to the interaction relationship, and make full use of the visual attention mechanism. At this time, the visual attention mechanism is adapted to the multi-view time data and the multi-view space data.

[0126] See also Figure 6 , S15: fusing the weight information, the multi-view time data and the multi-view spatial data, and outputting the fusion information;

[0127] In the specific implementation process of the present invention, the specific steps may be:

[0128] S151: Collect corresponding weights, multi-view time data, and multi-view spatial data;

[0129] S152: freeze the current node of the industrial Internet, and define the data detection level according to the current node of the industrial Internet;

[0130] S153: performing preliminary detection on the multi-view temporal data and the multi-view spatial data based on the data detection level, and outputting preliminary detection information;

[0131] S154: defining a data fusion level based on the preliminary detection information and the weight information;

[0132] S155: Fusing the multi-view temporal data and the multi-view spatial data according to the data fusion level, and outputting fusion information.

[0133] In an embodiment of the present application, corresponding weights, multi-view time data, and multi-view spatial data are collected; the current node of the Industrial Internet is frozen, and the data detection level is defined according to the current node of the Industrial Internet to facilitate control of the data detection level, thereby introducing the data detection level to facilitate application in different detection scenarios, so as to perform different levels of detection on different types of data.

[0134] Furthermore, based on the data detection level, the multi-view temporal data and the multi-view spatial data are preliminarily detected, and the preliminary detection information is output; the data fusion level is defined based on the preliminary detection information and the weight information; according to the data fusion level, the multi-view temporal data and the multi-view spatial data are fused, and the fusion information is output, so as to facilitate the fusion of the multi-view temporal data and the multi-view spatial data, and be compatible with the overall control of time and space.

[0135] Optionally, information from different spatial or temporal views is integrated. Since the importance of information from each upstream view may be different for each downstream view, the multi-view fusion block assigns different weights to each downstream block.

[0136] Optionally, the data fusion level, multi-view time data and multi-view space data are fixed, and the data fusion level, multi-view time data and multi-view space data are input into the fusion learning model. At this time, the data fusion level, multi-view time data and multi-view space data are used as input factors of the fusion learning model, and fusion information is output based on the fusion learning model.

[0137] See also Figure 7 ,S16: Filtering intrusion detection information based on the fusion information, and performing real-time intrusion detection on the data;

[0138] In the specific implementation process of the present invention, the specific steps may be:

[0139] S161: freeze frame fusion information;

[0140] S162: Divide the fused information into multiple information segments, and filter the intrusion detection information according to the traversal of the multiple information segments;

[0141] S163: Mark the intrusion path and the intrusion level according to the intrusion detection information;

[0142] S164: defining an invasion combination based on the matching of invasion paths and invasion levels;

[0143] S165: Perform real-time intrusion detection on data based on intrusion combinations, perform real-time intrusion detection on data in different dimensions, and evaluate the intrusion impact of data on the Industrial Internet in different dimensions.

[0144] In the embodiments of the present application, intrusion detection is compatible with time and space considerations, and full use is made of the interaction relationship between multi-view time data and multi-view space data, so as to ensure the accuracy of weight information in multiple dimensions, so as to integrate weight information, multi-view time data and multi-view space data, and then define intrusion detection information, realize real-time intrusion detection of data, ensure the detection accuracy of intrusion detection methods based on historical data and GCN, so as to realize accurate detection of log and traffic data, and provide personalized and accurate network security services for the industrial Internet.

[0145] Further, multiple information segments are divided based on the fusion information, and the intrusion detection information is screened according to the traversal of the multiple information segments, so as to control the intrusion detection information, thereby marking the intrusion path and the intrusion level according to the intrusion detection information, and then further controlling the intrusion path and the intrusion level. At this time, multiple information segments are traversed to introduce intrusion keywords, and matching is performed according to the intrusion keywords and the multiple information segments, so as to define the intrusion detection information according to the response of the intrusion keywords, and at the same time, the intrusion path and the intrusion level are further combined to form an intrusion combination according to the intrusion path and the intrusion level, and the intrusion combination includes the intrusion path and the intrusion level.

[0146] Therefore, the intrusion combination is defined based on the matching of the intrusion path and the intrusion level; the data is subjected to real-time intrusion detection according to the intrusion combination, and the data is subjected to real-time intrusion detection in different dimensions, and the intrusion impact of the data on the industrial Internet is evaluated in different dimensions. At this time, the intrusion detection is compatible with the consideration of time and space, and the interaction relationship between multi-view time data and multi-view space data is fully utilized, so as to ensure the accuracy of weight information in multiple dimensions, so as to integrate weight information, multi-view time data and multi-view space data, and then define intrusion detection information, realize real-time intrusion detection of data, and ensure the detection accuracy of the intrusion detection method based on historical data and GCN, so as to realize the accurate detection of log and flow data, and provide personalized and accurate network security services for the industrial Internet. Optionally, the multiple dimensions are time dimension and space dimension, and the intrusion impact of data on the industrial Internet is evaluated according to the time dimension and space dimension.

[0147] In addition, the intrusion detection method based on historical data and GCN corresponds to an intrusion detection module based on historical data and GCN. In the intrusion detection module based on historical data and GCN, it mainly consists of three parts: an embedding module, multiple multi-view spatiotemporal modules and an output module.

[0148] The input is the multi-granularity historical data and multiple graphs we defined in the previous section.

[0149] The multi-view time series data is then fed into an embedding module, which contains three embedding blocks for recent, daily, and weekly historical data. Each embedding block is a multi-layer neural network consisting of a fully connected layer (FC), an activation function (ReLU), a batch normalization (BN), and another fully connected layer (FC). After the initial embedding module, the embedding result is combined with multiple Figure 1 The output of each multi-view spatio-temporal module will be first added together with the initial embedding and then fed to the next module, inspired by ResNets, which can prevent over-smoothing of graph neural networks. That is, the sum of the output and the initial embedding, together with multiple graphs, are fed to the next multi-view spatio-temporal module. After the results are processed by the multi-view spatio-temporal module, the input-output module generates the final multi-step prediction. The results are concatenated together and input into the output block, which is similar to the embedding block, except that a dropout layer is added in front of the second FC layer to prevent overfitting. The core of the model is the multi-view spatio-temporal module, each of which has four key steps: multi-view time learning, view-intelligent fusion, multi-view spatial learning, and another view-intelligent fusion.

[0150] 1) Multi-view temporal learning

[0151] Since we consider historical data of three different granularities, multi-view temporal learning consists of three temporal learning operations, each of which processes historical observations embedded from a single view. Multi-view temporal learning produces three outputs, representing different temporal information extracted from different perspectives. The subsequent fusion module will receive the outputs and decide the best fusion ratio to integrate temporal information and generate input for each subsequent graph. We choose a dilated temporal convolutional network (TCN) to process each temporal data, and in each temporal learning, we have two TCNs connected by ReLU and BN layers. In addition, both the dilation operation and multi-granularity data maintain a large receptive field, which helps capture long-term temporal dependencies.

[0152] 2) Multi-view spatial learning

[0153] Multi-view spatial learning is used to mine relational information from different graphs that represent different spatial dependencies. Since we consider three different graphs, the input of multi-view spatial learning is the three integrated results from the multi-view fusion module, and the output is the three results of message passing through different graphs. The output of multi-view spatial learning will be fed into another multi-view fusion module to generate integrated results for subsequent processes.

[0154] In each spatial learning operation, there are two graph convolutional networks (GCNs) connected by ReLU and BN layers. In each GCN, information from neighbors will be passed through the edges, multiplied by the edge weights and aggregated. The aggregated neighbor information and node information are linearly transformed separately and finally added.

[0155] 3) Multiple attempts to integrate modules

[0156] The multi-view fusion block connects multi-view spatial learning and multi-view temporal learning. Its role is to determine the weights, integrate the outputs of upstream multi-view learning, and generate integrated results for downstream multi-view learning.

[0157] We propose a visual attention mechanism to determine the ideal weights to integrate information from different spatial or temporal views. Since the importance of information from each upstream view may be different for each downstream view, the multi-view fusion block assigns different weights to each downstream block respectively.

[0158] 4) Output module

[0159] The output module is used to generate the final prediction results. The input of the output module is the last round of fusion information. The input information will be first concatenated together and then pass through two FC layers connected by ReLU and BN layers. Dropout is added before the last FC layer to prevent overfitting.

[0160] See also Figure 8 , Figure 8 It is a schematic diagram of the structural composition of an intrusion detection system based on historical data and GCN in an embodiment of the present invention.

[0161] like Figure 8 As shown, an intrusion detection system based on historical data and GCN, the intrusion detection system based on historical data and GCN includes:

[0162] An acquisition module 21, used to acquire historical data and locate multi-view data based on the historical data;

[0163] A data module 22, configured to determine multi-view time data and multi-view spatial data based on the multi-view data;

[0164] An action relationship module 23, configured to trigger the GCN mechanism according to the multi-view temporal data and the multi-view spatial data, and define an action relationship between the multi-view temporal data and the multi-view spatial data;

[0165] A weight module 24, used to define weight information of the multi-view time data and the multi-view space data based on the interaction relationship between the visual attention mechanism and the multi-view time data and the multi-view space data;

[0166] A fusion information module 25, configured to fuse the multi-view temporal data and the multi-view spatial data according to the weight information, and output fusion information;

[0167] The detection module 26 is used to filter the intrusion detection information based on the fusion information and perform real-time intrusion detection on the data.

[0168] See also Fig. 9 , refer to the following Fig. 9 The electronic device 40 according to this embodiment of the present invention will be described. Fig. 9 The electronic device 40 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0169] like Fig. 9 As shown, the electronic device 40 is in the form of a general computing device. The components of the electronic device 40 may include but are not limited to: at least one processing unit 41, at least one storage unit 42, and a bus 43 connecting different system components (including the storage unit 42 and the processing unit 41).

[0170] The storage unit stores program codes, which can be executed by the processing unit 41, so that the processing unit 41 executes the steps according to various exemplary embodiments of the present invention described in the above “Embodiment Method” section of this specification.

[0171] The storage unit 42 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit 421 and / or a cache storage unit 422 , and may further include a read-only storage unit (ROM) 423 .

[0172] The storage unit 42 may also include a program / utility 424 having a set (at least one) of program modules 425, such program modules 425 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0173] Bus 43 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0174] The electronic device 40 may also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device 40, and / or any device that enables the electronic device 40 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 44. Furthermore, the electronic device 40 may also communicate with one or more networks (e.g., local area networks, wide area networks, and / or public networks, such as the Internet) via a network adapter 45. Fig. 9 As shown, the network adapter 45 communicates with other modules of the electronic device 40 via the bus 43. It should be understood that although Fig. 9 Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 40, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, tape drives, and data backup planning systems.

[0175] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0176] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, and the storage medium can include: a read-only memory, a random access memory, a disk or an optical disk, etc. In addition, it stores computer program instructions, and when the computer program instructions are executed by a computer, the computer executes the above method.

[0177] In addition, the above intrusion detection method and system based on historical data and GCN provided by the embodiments of the present invention are introduced in detail. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the ideas of the present invention, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. An intrusion detection method based on historical data and GCN, characterized in that: Applied to intrusion detection scenarios based on historical data and GCN; The intrusion detection method based on historical data and GCN includes: Acquire historical data and locate multi-view data based on the historical data; Determining multi-view temporal data and multi-view spatial data based on the multi-view data; The GCN mechanism is triggered according to the multi-view temporal data and the multi-view spatial data, and the interaction relationship between the multi-view temporal data and the multi-view spatial data is defined; Based on the interaction relationship between the visual attention mechanism and the multi-view temporal data and the multi-view spatial data, the weight information of the multi-view temporal data and the multi-view spatial data is defined; Fusing the weight information, the multi-view temporal data, and the multi-view spatial data, and outputting the fused information; Filter intrusion detection information based on fusion information and perform real-time intrusion detection on data; The method triggers the GCN mechanism according to the multi-view time data and the multi-view space data, and defines the interaction relationship between the multi-view time data and the multi-view space data, including: freezing the multi-view time data and the multi-view space data; associating the multi-view time data and the multi-view space data; triggering the GCN mechanism based on the multi-view time data and the multi-view space data; in the GCN mechanism, performing multi-level convolution on the multi-view time data and the multi-view space data, and performing edge transmission on the multi-view time data and the multi-view space data during the multi-level convolution process; collecting edge weights, and aggregating according to the edge weights and the edge data in the multi-view time data and the multi-view space data to form an aggregation result; performing linear transformation according to the aggregation result and the data node information to define the interaction relationship between the multi-view time data and the multi-view space data.

2. The intrusion detection method based on historical data and GCN according to claim 1, characterized in that: The acquiring of historical data and positioning of multi-view data based on the historical data includes: Obtain historical data based on the Industrial Internet; Divide historical data into multiple data sets; Locating multi-view data based on parsing of multiple data sets; For multi-view data, trigger data preprocessing based on multi-view data and locate abnormal data; The abnormal nodes and abnormal numbers corresponding to the abnormal data are collected, and the abnormal levels are defined according to the abnormal nodes and abnormal numbers. The optimization of the abnormal data is triggered based on the abnormal level to improve the multi-view data.

3. The intrusion detection method based on historical data and GCN according to claim 1, characterized in that: The determining of multi-view time data and multi-view spatial data based on the multi-view data includes: Freeze multi-view data; Label the corresponding attributes based on the multi-view data, and filter the temporal attributes and spatial attributes; Determine multi-view time data according to the time attribute and the multi-view data; Marking time classes based on multi-view time data and dividing the multi-view time data into different time periods; Determine multi-view spatial data according to the spatial attribute and the multi-view data; Marking spatial classes based on multi-view spatial data and dividing multi-view spatial data in different spaces; Dynamic interaction is performed based on multi-view temporal data of different time periods and multi-view spatial data of different spaces to form a temporal-spatial multi-view data combination, and an overall operation is performed based on the temporal-spatial multi-view data combination.

4. The intrusion detection method based on historical data and GCN according to claim 1, characterized in that: The method of defining weight information of multi-view time data and multi-view space data based on the interaction relationship between the visual attention mechanism and the multi-view time data and the multi-view space data includes: Freeze the interaction between multi-view temporal data and multi-view spatial data; Relate visual attention mechanisms and their role; The interaction relationship is controlled according to the visual attention mechanism, and the multi-view temporal data and the multi-view spatial data are optimized based on the visual attention mechanism to define the weight information of the multi-view temporal data and the multi-view spatial data.

5. The intrusion detection method based on historical data and GCN according to claim 1, characterized in that: The fusing the weight information, the multi-view time data and the multi-view space data and outputting the fused information includes: Collect corresponding weights, multi-view temporal data, and multi-view spatial data; Freeze the current node of the Industrial Internet and define the data detection level based on the current node of the Industrial Internet.

6. The intrusion detection method based on historical data and GCN according to claim 5, characterized in that: The method of fusing the weight information, the multi-view time data and the multi-view space data and outputting the fusion information further includes: Perform preliminary detection on the multi-view temporal data and the multi-view spatial data based on the data detection level, and output preliminary detection information; Defining a data fusion level based on preliminary detection information and weight information; According to the data fusion level, multi-view time data and multi-view spatial data are fused and the fusion information is output.

7. The intrusion detection method based on historical data and GCN according to claim 6, characterized in that: The intrusion detection information is screened based on the fusion information, and real-time intrusion detection is performed on the data, including: Freeze-frame fusion information; Divide multiple information segments based on the fusion information, and filter the intrusion detection information according to the traversal of the multiple information segments; Mark the intrusion path and intrusion level according to the intrusion detection information; Defining invasion combinations based on the matching of invasion pathways and invasion levels; Perform real-time intrusion detection on data based on intrusion combinations, perform real-time intrusion detection on data in different dimensions, and evaluate the intrusion impact of data on the Industrial Internet in different dimensions.

8. An intrusion detection system based on historical data and GCN, characterized in that: The intrusion detection system based on historical data and GCN is applied to the intrusion detection method based on historical data and GCN as claimed in any one of claims 1 to 7, and the intrusion detection system based on historical data and GCN includes: An acquisition module, used for acquiring historical data and locating multi-view data based on the historical data; A data module, configured to determine multi-view time data and multi-view spatial data based on the multi-view data; The action relationship module is used to trigger the GCN mechanism according to the multi-view temporal data and the multi-view spatial data, and define the action relationship between the multi-view temporal data and the multi-view spatial data; A weight module, used to define weight information of the multi-view time data and the multi-view space data based on the interaction relationship between the visual attention mechanism and the multi-view time data and the multi-view space data; A fusion information module, used for fusing the weight information, the multi-view temporal data and the multi-view spatial data, and outputting the fusion information; The detection module is used to filter intrusion detection information based on fusion information and perform real-time intrusion detection on the data; The method triggers the GCN mechanism according to the multi-view time data and the multi-view space data, and defines the interaction relationship between the multi-view time data and the multi-view space data, including: freezing the multi-view time data and the multi-view space data; associating the multi-view time data and the multi-view space data; triggering the GCN mechanism based on the multi-view time data and the multi-view space data; in the GCN mechanism, performing multi-level convolution on the multi-view time data and the multi-view space data, and performing edge transmission on the multi-view time data and the multi-view space data during the multi-level convolution process; collecting edge weights, and aggregating according to the edge weights and the edge data in the multi-view time data and the multi-view space data to form an aggregation result; performing linear transformation according to the aggregation result and the data node information to define the interaction relationship between the multi-view time data and the multi-view space data.

Images