Network intrusion detection method and terminal based on multi-level network traffic information fusion

Abstract

The application discloses a network intrusion detection method and terminal based on multi-level network flow information fusion, pre-processes obtained network flow data to obtain network flow data, constructs a data packet time sequence diagram and a flow correlation diagram based on the network flow data, inputs the data packet time sequence diagram into a flow level diagram processing model in a double-layer intrusion detection model, outputs graph representation features of the data packet time sequence diagram, extracts node features of the flow correlation diagram, fuses the graph representation features and the node features, inputs new node features obtained to a network flow detection model in the double-layer intrusion detection model, considers the relationship between data of two granularities by constructing the data packet time sequence diagram and the flow correlation diagram, and simultaneously based on multi-level network flow information fusion, so that flow features in the input model are more abundant, the disturbance on fused node features is less, and the robustness can be guaranteed, thereby realizing efficient and accurate network intrusion detection.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network intrusion detection method and terminal based on multi-level network flow information fusion. Background Art

[0002] With the rapid development of information and communication technologies, the internet has brought tremendous convenience to people's lives. However, this widespread adoption has also created numerous hidden dangers, and information security has gradually become a major concern. Cyber ​​attackers use various methods, including DDoS (Distributed Denial of Service) attacks, backdoor attacks, fuzzing attacks, and eavesdropping attacks, to modify, destroy, or steal user privacy data. Currently, multiple regions within my country are frequently subject to various levels of malicious attacks, with organizations in government, defense, finance, scientific research, education, and other sectors becoming key targets. The security situation is extremely severe.

[0003] Current network intrusion detection systems (NIDS) primarily utilize machine learning and deep learning methods to detect malicious traffic. Machine learning-based NIDS can improve detection accuracy by analyzing network user and system behavior to identify potential anomaly patterns. However, this approach typically processes network traffic in isolation, ignoring the inherent structure and topology information within it and failing to effectively leverage relationships between traffic flows. Compared to machine learning, deep learning-based NIDS can learn the input-output mapping relationship directly from raw data through end-to-end learning, eliminating the need to manually design complex rules or features. This simplifies the system and reduces reliance on domain expertise. However, this approach requires a large amount of data for training, and its performance is data-intensive, requiring high computational resources and exhibiting poor generalization.

[0004] Therefore, how to achieve efficient and accurate network intrusion detection has become an urgent problem to be solved. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a network intrusion detection method and terminal based on multi-level network traffic information fusion, which can realize efficient and accurate network intrusion detection.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0007] A network intrusion detection method based on multi-level network traffic information fusion, comprising the steps of:

[0008] Acquiring network traffic data and preprocessing the network traffic data to obtain network flow data;

[0009] Constructing a data packet timing diagram and a flow association diagram based on the network flow data;

[0010] Inputting the data packet timing graph into a flow-level graph processing model in a two-layer intrusion detection model, outputting graph representation features of the data packet timing graph, and extracting node features of the flow association graph;

[0011] The graph representation feature and the node feature are fused to obtain a new node feature, and the new node feature is input into a network traffic detection model in a double-layer intrusion detection model to output a detection result.

[0012] In order to solve the above technical problems, another technical solution adopted by the present invention is:

[0013] A network intrusion detection terminal based on multi-level network traffic information fusion includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the following steps are implemented:

[0014] Acquiring network traffic data and preprocessing the network traffic data to obtain network flow data;

[0015] Constructing a data packet timing diagram and a flow association diagram based on the network flow data;

[0016] Inputting the data packet timing graph into a flow-level graph processing model in a two-layer intrusion detection model, outputting graph representation features of the data packet timing graph, and extracting node features of the flow association graph;

[0017] The graph representation feature and the node feature are fused to obtain a new node feature, and the new node feature is input into a network traffic detection model in a double-layer intrusion detection model to output a detection result.

[0018] The beneficial effects of the present invention are: preprocessing the acquired network traffic data to obtain network flow data, constructing a data packet timing diagram and a flow association diagram based on the network flow data, inputting the data packet timing diagram into the flow-level graph processing model in the double-layer intrusion detection model, outputting the graph representation features of the data packet timing diagram, extracting the node features of the flow association diagram, fusing the graph representation features and the node features, and inputting the obtained new node features into the network traffic detection model in the double-layer intrusion detection model. By constructing the data packet timing diagram and the flow association diagram, the relationship between the data of the two granularities is comprehensively considered. At the same time, based on the fusion of multi-level network traffic information, the traffic features in the input model are enriched, the fused node features are less disturbed, and the robustness can be guaranteed, thereby achieving efficient and accurate network intrusion detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A flowchart of a network intrusion detection method based on multi-level network traffic information fusion according to an embodiment of the present invention;

[0020] Figure 2 This is a schematic structural diagram of a network intrusion detection terminal based on multi-level network traffic information fusion according to an embodiment of the present invention;

[0021] Figure 3 A schematic diagram of a process for constructing a data packet timing diagram in a network intrusion detection method based on multi-level network traffic information fusion according to an embodiment of the present invention;

[0022] Figure 4 Schematic diagram of the process of constructing a flow association graph in a network intrusion detection method based on multi-level network flow information fusion according to an embodiment of the present invention;

[0023] Figure 5 A structural block diagram of a double-layer intrusion detection model in a network intrusion detection method based on multi-layer network traffic information fusion according to an embodiment of the present invention;

[0024] Figure 6 This is a schematic diagram of the fusion of a data packet timing diagram and a flow association diagram in a network intrusion detection method based on multi-level network traffic information fusion according to an embodiment of the present invention. DETAILED DESCRIPTION

[0025] To illustrate the technical content, achieved objectives and effects of the present invention in detail, the following description is given in conjunction with the embodiments and accompanying drawings.

[0026] Please refer to Figure 1 , a network intrusion detection method based on multi-level network traffic information fusion, comprising the steps of:

[0027] Acquiring network traffic data and preprocessing the network traffic data to obtain network flow data;

[0028] Constructing a data packet timing diagram and a flow association diagram based on the network flow data;

[0029] Inputting the data packet timing graph into a flow-level graph processing model in a two-layer intrusion detection model, outputting graph representation features of the data packet timing graph, and extracting node features of the flow association graph;

[0030] The graph representation feature and the node feature are fused to obtain a new node feature, and the new node feature is input into a network traffic detection model in a double-layer intrusion detection model to output a detection result.

[0031] From the above description, it can be seen that the beneficial effects of the present invention are: preprocessing the acquired network traffic data to obtain network flow data, constructing a data packet timing graph and a flow association graph based on the network flow data, inputting the data packet timing graph into the flow-level graph processing model in the two-layer intrusion detection model, outputting the graph representation features of the data packet timing graph, and extracting the node features of the flow association graph, fusing the graph representation features and the node features, and inputting the obtained new node features into the network traffic detection model in the two-layer intrusion detection model. By constructing the data packet timing graph and the flow association graph, the relationship between the data of the two granularities is comprehensively considered. At the same time, based on the multi-level network traffic information fusion, the traffic features in the input model are richer, the fused node features are less disturbed, and the robustness can be guaranteed, thereby achieving efficient and accurate network intrusion detection.

[0032] Furthermore, the network traffic data includes a network quintuple;

[0033] The preprocessing of the network traffic data to obtain the network flow data includes:

[0034] Eliminating missing values ​​and outliers in the network traffic data to obtain eliminated network traffic data;

[0035] Extracting a plurality of data packets from the eliminated network traffic data as filtered network traffic data;

[0036] Sorting the filtered network traffic data according to time series to obtain sorted network traffic data;

[0037] Converting the network quintuples in the sorted network traffic data into network triples to obtain converted network traffic data, and performing data cleaning on the converted network traffic data to obtain cleaned network traffic data;

[0038] Normalizing the information in the cleaned network traffic data to obtain normalized information;

[0039] A network traffic processing method is used to generate network flow data based on the normalized information.

[0040] From the above description, it can be seen that when preprocessing the data, extracting multiple data packets from the eliminated network traffic data as the filtered network traffic data can reduce the amount of data that needs to be processed and improve the efficiency of detection and analysis. Converting the network quintuple in the sorted network traffic data into a network triple can reduce redundant information and simplify the model input, so as to better capture and express the communication pattern of the network traffic.

[0041] Furthermore, after removing missing values ​​and outliers from the network traffic data to obtain the removed network traffic data, the method further includes:

[0042] Extracting length sequence information and payload information of data packets from the removed network traffic data;

[0043] The constructing of a data packet timing diagram and a flow association diagram based on the network flow data includes:

[0044] Mapping data packets in the network flow data into nodes, normalizing the original bytes in each of the data packets, and storing the normalized bytes as node features in the nodes;

[0045] Generate edges between the nodes according to the timestamps of the data packets and the order of transmission of the data packets;

[0046] generating a data packet timing graph according to the nodes and the edges, and storing the length sequence information and the payload information as meta-features in a global attribute of the data packet timing graph;

[0047] Constructing a bipartite graph according to the network flow data, wherein the bipartite graph includes a source node set, a target node set, and an edge set;

[0048] Constructing virtual nodes according to the number of source nodes in the source node set and the number of target nodes in the target node set, and adding the virtual nodes to the bipartite graph based on a node random mapping mechanism;

[0049] The bipartite graph is converted into a line graph according to line graph theory, and the line graph is used as a flow association graph.

[0050] From the above description, we can see that the packet timing diagram is constructed based on the topological relationship and time relationship between data packets, and the bipartite graph is transformed using line graph theory. In the final flow association graph, the flows are represented as nodes, and the relationships between flows are converted into edges. This enriches the topological information between flows, allowing for more accurate identification of malicious network traffic.

[0051] Furthermore, the step of inputting the data packet timing diagram into the flow-level graph processing model in the two-layer intrusion detection model and outputting the graph representation features of the data packet timing diagram includes:

[0052]

[0053] Where h G The graph representing the timing diagram of the data packet represents a feature, CONCAT() represents a connection operation in a neural network, represents the feature vector of node v at the kth iteration, G represents the set of all nodes, and K represents the total number of iterations.

[0054] From the above description, it can be seen that the graph representation features of the packet timing graph are generated by aggregating all node features, which can reflect the real traffic information and ensure the accuracy of network traffic intrusion detection.

[0055] Furthermore, before obtaining the network traffic data, the method further includes:

[0056] Establish a three-layer multilayer perceptron, each layer of which includes a linear function and a BatchNorm function;

[0057] Generate a flow graph processing model based on the three-layer multi-layer perceptron;

[0058] A network traffic detection model is constructed based on two layers of graph convolutional neural network and two layers of activation functions;

[0059] A two-layer intrusion detection model is generated according to the flow-level graph processing model and the network traffic detection model.

[0060] From the above description, it can be seen that the flow-level graph processing model includes a three-layer multi-layer perceptron, which can realize complex nonlinear mapping and capture complex patterns and relationships in network traffic data. It is very effective in distinguishing different types of network traffic. At the same time, the network traffic detection model consists of two layers of graph convolutional neural network layers and two layers of activation functions. It utilizes the smoothness assumption of the graph, that is, adjacent nodes have similar characteristics, which helps to achieve smoother and more consistent classification results in network traffic classification, thereby facilitating the discovery of abnormal traffic patterns and achieving more effective and reliable intrusion detection.

[0061] Please refer to Figure 2 A network intrusion detection terminal based on multi-level network traffic information fusion includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the following steps are implemented:

[0062] Acquiring network traffic data and preprocessing the network traffic data to obtain network flow data;

[0063] Constructing a data packet timing diagram and a flow association diagram based on the network flow data;

[0064] Inputting the data packet timing graph into a flow-level graph processing model in a two-layer intrusion detection model, outputting graph representation features of the data packet timing graph, and extracting node features of the flow association graph;

[0065] The graph representation feature and the node feature are fused to obtain a new node feature, and the new node feature is input into a network traffic detection model in a double-layer intrusion detection model to output a detection result.

[0066] From the above description, it can be seen that the beneficial effects of the present invention are: preprocessing the acquired network traffic data to obtain network flow data, constructing a data packet timing graph and a flow association graph based on the network flow data, inputting the data packet timing graph into the flow-level graph processing model in the two-layer intrusion detection model, outputting the graph representation features of the data packet timing graph, and extracting the node features of the flow association graph, fusing the graph representation features and the node features, and inputting the obtained new node features into the network traffic detection model in the two-layer intrusion detection model. By constructing the data packet timing graph and the flow association graph, the relationship between the data of the two granularities is comprehensively considered. At the same time, based on the multi-level network traffic information fusion, the traffic features in the input model are richer, the fused node features are less disturbed, and the robustness can be guaranteed, thereby achieving efficient and accurate network intrusion detection.

[0067] Furthermore, the network traffic data includes a network quintuple;

[0068] The preprocessing of the network traffic data to obtain the network flow data includes:

[0069] Eliminating missing values ​​and outliers in the network traffic data to obtain eliminated network traffic data;

[0070] Extracting a plurality of data packets from the eliminated network traffic data as filtered network traffic data;

[0071] Sorting the filtered network traffic data according to time series to obtain sorted network traffic data;

[0072] Converting the network quintuples in the sorted network traffic data into network triples to obtain converted network traffic data, and performing data cleaning on the converted network traffic data to obtain cleaned network traffic data;

[0073] Normalizing the information in the cleaned network traffic data to obtain normalized information;

[0074] A network traffic processing method is used to generate network flow data based on the normalized information.

[0075] From the above description, it can be seen that when preprocessing the data, extracting multiple data packets from the eliminated network traffic data as the filtered network traffic data can reduce the amount of data that needs to be processed and improve the efficiency of detection and analysis. Converting the network quintuple in the sorted network traffic data into a network triple can reduce redundant information and simplify the model input, so as to better capture and express the communication pattern of the network traffic.

[0076] Furthermore, after removing missing values ​​and outliers from the network traffic data to obtain the removed network traffic data, the method further includes:

[0077] Extracting length sequence information and payload information of data packets from the removed network traffic data;

[0078] The constructing of a data packet timing diagram and a flow association diagram based on the network flow data includes:

[0079] Mapping data packets in the network flow data into nodes, normalizing the original bytes in each of the data packets, and storing the normalized bytes as node features in the nodes;

[0080] Generate edges between the nodes according to the timestamps of the data packets and the order of transmission of the data packets;

[0081] generating a data packet timing graph according to the nodes and the edges, and storing the length sequence information and the payload information as meta-features in a global attribute of the data packet timing graph;

[0082] Constructing a bipartite graph according to the network flow data, wherein the bipartite graph includes a source node set, a target node set, and an edge set;

[0083] Constructing virtual nodes according to the number of source nodes in the source node set and the number of target nodes in the target node set, and adding the virtual nodes to the bipartite graph based on a node random mapping mechanism;

[0084] The bipartite graph is converted into a line graph according to line graph theory, and the line graph is used as a flow association graph.

[0085] From the above description, we can see that the packet timing diagram is constructed based on the topological relationship and time relationship between data packets, and the bipartite graph is transformed using line graph theory. In the final flow association graph, the flows are represented as nodes, and the relationships between flows are converted into edges. This enriches the topological information between flows, allowing for more accurate identification of malicious network traffic.

[0086] Furthermore, the step of inputting the data packet timing diagram into the flow-level graph processing model in the two-layer intrusion detection model and outputting the graph representation features of the data packet timing diagram includes:

[0087]

[0088] Where h G The graph representing the timing diagram of the data packet represents a feature, CONCAT() represents a connection operation in a neural network, represents the feature vector of node v at the kth iteration, G represents the set of all nodes, and K represents the total number of iterations.

[0089] From the above description, it can be seen that the graph representation features of the packet timing graph are generated by aggregating all node features, which can reflect the real traffic information and ensure the accuracy of network traffic intrusion detection.

[0090] Furthermore, before obtaining the network traffic data, the method further includes:

[0091] Establish a three-layer multilayer perceptron, each layer of which includes a linear function and a BatchNorm function;

[0092] Generate a flow graph processing model based on the three-layer multi-layer perceptron;

[0093] A network traffic detection model is constructed based on two layers of graph convolutional neural network and two layers of activation functions;

[0094] A two-layer intrusion detection model is generated according to the flow-level graph processing model and the network traffic detection model.

[0095] From the above description, it can be seen that the flow-level graph processing model includes a three-layer multi-layer perceptron, which can realize complex nonlinear mapping and capture complex patterns and relationships in network traffic data. It is very effective in distinguishing different types of network traffic. At the same time, the network traffic detection model consists of two layers of graph convolutional neural network layers and two layers of activation functions. It utilizes the smoothness assumption of the graph, that is, adjacent nodes have similar characteristics, which helps to achieve smoother and more consistent classification results in network traffic classification, thereby facilitating the discovery of abnormal traffic patterns and achieving more effective and reliable intrusion detection.

[0096] The network intrusion detection method and terminal based on multi-level network traffic information fusion of the present invention can be applied to network intrusion detection scenarios, and are described below through specific implementation methods:

[0097] Please refer to Figure 1 、 Figure 3-Figure 6 , embodiment 1 of the present invention is:

[0098] A network intrusion detection method based on multi-level network traffic information fusion, comprising the steps of:

[0099] S1. Establish a three-layer multilayer perceptron. Each layer of the multilayer perceptron includes a linear function (LinerFunction) and a BatchNorm function (BN Function).

[0100] The linear function performs a linear transformation, learning weights and biases during training. The BatchNorm function ensures that the inputs to each MLP layer have the same distribution during training. Each layer of the multilayer perceptron acts as a recursive neighborhood aggregation scheme, where the feature vector of each node is calculated by aggregating the features of its neighbors. Therefore, a node feature vector can store feature information about neighboring nodes in the graph.

[0101] S2. Generate a flow graph processing model based on the three-layer multi-layer perceptron.

[0102] S3. Build a network traffic detection model based on two graph convolutional neural network (GCN) layers and two activation functions. Graph convolutional neural networks exploit the smoothness assumption of graphs, i.e., adjacent nodes have similar features. This helps achieve smoother and more consistent classification results in network traffic classification, thus facilitating the discovery of abnormal traffic patterns.

[0103] The loss function used in the graph convolutional neural network layer is the cross entropy loss function, specifically:

[0104]

[0105] Where, represents the cross entropy loss function, N1 represents the number of samples, represents the regularization factor, C represents the number of categories, y i,c represents the actual label of category c in sample i, Γ i,c It represents the probability of predicting sample i as category c.

[0106] S4, generating a two-layer intrusion detection model based on the flow-level graph processing model and the network traffic detection model, such as Figure 5 shown.

[0107] S5. Acquire network traffic data and pre-process the network traffic data to obtain network flow data, specifically including S51-S58:

[0108] S51. Obtain network traffic data.

[0109] The network traffic data includes a network quintuple, which includes a source IP address, a source port, a destination IP address, a destination port, and a protocol.

[0110] S52: Eliminate missing values ​​and abnormal values ​​in the network traffic data to obtain the eliminated network traffic data.

[0111] S53: Extracting length sequence information and payload information of data packets from the removed network traffic data.

[0112] Specifically, flowcontainertool (a network traffic basic information extraction library developed based on Python) is used to extract the length sequence information and payload information of the data packets from the removed network traffic data.

[0113] S54: extracting multiple data packets from the eliminated network traffic data as filtered network traffic data.

[0114] Specifically, the first N data packets are extracted from each of the eliminated network traffic data as representations of the network traffic data to obtain filtered network traffic data, thereby significantly reducing the amount of data to be processed and improving the efficiency of real-time detection and analysis.

[0115] S55 , sorting the filtered network traffic data according to time series to obtain sorted network traffic data.

[0116] S56: Convert the network quintuples in the sorted network traffic data into network triples to obtain converted network traffic data, and perform data cleaning on the converted network traffic data to obtain cleaned network traffic data.

[0117] The network triplet includes source IP address+source port, destination IP address+destination port and protocol.

[0118] Specifically, the network quintuple including the source IP address, source port, destination IP address, destination port and protocol in the sorted network traffic data is converted into a network triple including the source IP address + source port, destination IP address + destination port and protocol, aiming to improve processing efficiency, reduce redundant information, simplify model input, so as to better capture and express the communication pattern of network traffic; the converted network traffic data is cleaned to remove biased data and useless data therein to obtain cleaned network traffic data.

[0119] S57: normalize the information in the cleaned network traffic data to obtain normalized information.

[0120] S58: Generate network flow data according to the normalized information using a network flow processing method.

[0121] Specifically, the obtained normalized information is used as manual features of network traffic, and a network traffic processing method is used to generate network flow data.

[0122] S6. Constructing a data packet timing diagram and a flow association diagram based on the network flow data, specifically including S61-S66:

[0123] S61. Mapping data packets in the network flow data to nodes, normalizing the original bytes in each of the data packets, and storing the normalized bytes as node features in the nodes.

[0124] S62: Generate edges between the nodes according to the timestamps of the data packets and the order of transmission of the data packets.

[0125] Specifically, edges are generated between the node at the current time and the node at the next time according to the timestamp order of the data packet, and edges are generated between the last tail node and the head node, and then edges are generated between non-adjacent nodes according to the order of the data packet transmission.

[0126] S63: Generate a data packet timing graph according to the nodes and the edges, and store the length sequence information and the payload information as meta-features in the global attributes of the data packet timing graph.

[0127] Map the extracted data packets to nodes, denoted as n i , where i = {1,…,k}, k represents the number of all nodes. The raw bytes in each data packet are normalized and stored in the node as node features. The node feature dimension is set to 1500, corresponding to the size of the maximum transmission unit (MTU). Secondly, the edges are assigned according to the timestamp of the data packet. The timestamp of the data packet is represented as t i , that is, the arrival time between packets k and k-1, which can be expressed as t k -t k-1 Calculate and store it as the weight of the edge, denoted as ω (k,k-1) , the obtained edge is recorded as e (k-1,k) Each node is connected by traversal edges according to the timestamp of the data packet. The traversal edge set is E t ={e (1,2) ,e (2,3) ..,e (k-1,k)}, and then add edges between non-adjacent nodes according to the order of data packet transmission, and get the final edge set E = {e (1,2) ,e (1,3) ..,e (k-1,k)}; Among them, the time relationship and time information between data packets are used as edge attributes; finally, the packet length sequence information and partial information contained in the payload information (such as average load length, standard deviation of payload length, average packet length, standard deviation of packet length, and flow duration) are stored as meta-features of the packet in the global attributes of the packet timing graph.

[0128] like Figure 3As shown, assuming that 4 data packets are used to represent a flow, there are 4 nodes n0, n1, n2, n3 in the figure. According to the time sequence, the transmission direction of the data packets at this time is n k-1 →n k . Add 4 edges according to the transmission direction, namely n0→n1, n1→n2, n2→n3. To ensure the integrity of a flow event and the connectivity of the message passing process between data packets, add a transfer relation edge n3→n0 between node n0 and node n3, thus forming a complete traversal edge of the data packet time sequence diagram.

[0129] After the traversal edges are added, each node is connected to the node where the data packet arrives earlier through the arrival traversal edge, and is connected to the node where the data packet arrives later through the departure traversal edge. That is, according to the time stamp t i of the data packet. Assuming that the time stamps of each node in the figure are t0, t1, t2, t3 respectively, according to the time stamps, the time information relationship of the nodes is t0 < t1 < t2 < t3. The smaller the time information, the earlier the node arrives. Therefore, it can be known that node n4 is the latest arrival node, and a transfer relation edge will be added between nodes n0, n1, n2 and node n3 respectively. Since there is a traversal edge between node n2 and node n3, no edge relationship is added. Finally, two edge relationships n0→n3 and n1→n3 are added to node n3.

[0130] By analogy with the above method, add edge relationships between each late arrival node and early arrival node, and finally form an edge set. Denote n0→n3 as e (0,3) , then the edge set of this graph can be expressed as E = {e (0,1) , e (0,2) , e (0,3) , e (1,2) , e (1,3) , e (2,3)}. Finally, use the meta-feature method to store the meta-features of the data packets in the global attributes of the data packet time sequence diagram.

[0131] S64. Construct a bipartite graph according to the network flow data, where the bipartite graph includes a source node set, a target node set and an edge set.

[0132] S65. Construct virtual nodes according to the number of source nodes in the source node set and the number of target nodes in the target node set, and add the virtual nodes to the bipartite graph based on the node random mapping mechanism.

[0133] Specifically, if the number of source nodes in the source node set is less than the number of target nodes in the target node set, virtual nodes are constructed to expand the source node set, and the virtual nodes are used to randomly replace some source nodes in the source node set until the number of source nodes in the source node set is equal to the number of target nodes in the target node set; if the number of target nodes in the target node set is less than the number of source nodes in the source node set, virtual nodes are constructed to expand the target node set until the number of target nodes in the target node set is equal to the number of source nodes in the source node set, so as to effectively balance the number of source nodes and the number of target nodes, and the node random mapping mechanism helps to avoid dependence on specific nodes during model learning, thereby improving the generalization ability of the model.

[0134] S66. Convert the bipartite graph into a line graph according to line graph theory, and use the line graph as a flow association graph.

[0135] Specifically, the edges in the bipartite graph are corresponded to the nodes in the line graph, and the nodes in the bipartite graph are corresponded to the edges in the line graph, thereby converting and generating a line graph, and the line graph is used as the flow association graph.

[0136] like Figure 4 As shown, a bipartite graph G = (S, D, E) is constructed, where S represents the source node set, D represents the target node set, and E represents the edge set. Assuming there are three source nodes and three target nodes, then the source node set S = {1, 2, 3}, the target node set D = {a, b, c}, the edge between source node 1 and target node a is 1a, and the edge set in the graph is E = {1a, 1b, 1c, 2b, 2c, 3b, 3c}; secondly, a virtual node N is constructed to balance the number of nodes in the source node set S and the target node set D, and the virtual nodes are used to randomly replace the source nodes of the edges in the graph G to increase the number of nodes, thereby reducing the average node degree and preventing Potential problems at the source node provide a non-malicious label for malicious traffic. Finally, since the nodes in the bipartite graph G are featureless, the bipartite graph can be converted into a line graph G' = (S', D', E') using line-graph theory. The edge set in graph G is converted into the node set N' = {1a, 1b, 1c, 2b, 2c, 3b, 3c} in graph G', and the nodes at both ends of the edges in graph G are converted into edges in the line graph G'. The resulting line graph is the flow association graph, which enriches the topological information between flows. This solution does not require complex modifications to the graph model and optimizes the graph structure, providing richer information and faster processing speed.

[0137] S7. Input the data packet timing graph into the flow-level graph processing model in the double-layer intrusion detection model, output the graph representation features of the data packet timing graph, and extract the node features of the flow association graph.

[0138] The data packet timing diagram is input into the flow-level graph processing model in the two-layer intrusion detection model, and the Readout function is used to aggregate all node features to generate graph representation features. Therefore, the data packet timing diagram is input into the flow-level graph processing model in the two-layer intrusion detection model, and the graph representation features of the data packet timing diagram are outputted, including:

[0139]

[0140] Where h G The graph representing the timing diagram of the data packet represents a feature, CONCAT() represents a connection operation in a neural network, represents the feature vector of node v at the kth iteration, G represents the set of all nodes, and K represents the total number of iterations.

[0141] The update formula of the node feature vector is:

[0142]

[0143] Where,∈ (k) represents the learning parameters at the kth iteration, represents the feature vector of node v at the k-1th iteration, Represents the set of neighbor nodes of node v, MLP k Modeled as f() represents the node aggregation function, represents the node update function, ° represents the dot product operation, and these two functions are obtained through MLP learning.

[0144] S8, the graph representation feature and the node feature are fused to obtain a new node feature, such as Figure 6 As shown, the new node features are input into the network traffic detection model in the double-layer intrusion detection model to output the detection results.

[0145] Figure 6 Here, f0, f1, and f2 are nodes in the flow association graph, which contain node features.

[0146] Please refer to Figure 2 , the second embodiment of the present invention is:

[0147] A network intrusion detection terminal based on multi-level network traffic information fusion includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, each step of the network intrusion detection method based on multi-level network traffic information fusion in Example 1 is implemented.

[0148] In summary, the present invention provides a network intrusion detection method and terminal based on multi-level network traffic information fusion, which preprocesses the acquired network traffic data to obtain network flow data, constructs a data packet timing diagram and a flow association diagram based on the network flow data, inputs the data packet timing diagram into the flow-level graph processing model in the double-layer intrusion detection model, outputs the graph representation features of the data packet timing diagram, extracts the node features of the flow association diagram, fuses the graph representation features and the node features, and inputs the obtained new node features into the network traffic detection model in the double-layer intrusion detection model. By constructing the data packet timing diagram and the flow association diagram, the relationship between the data of the two granularities is comprehensively considered. At the same time, based on the multi-level network traffic information fusion, the traffic features in the input model are richer, the fused node features are less disturbed, and the robustness can be guaranteed, thereby achieving high efficiency and accuracy. network intrusion detection; in addition, a packet timing diagram is constructed based on the topological relationship and time relationship between data packets, and the bipartite graph is transformed using line graph theory, so that the flows in the final flow association graph are represented as nodes, and the relationship between flows is converted into edges, making the topological information between flows richer, so as to more accurately identify malicious network traffic; and the flow-level graph processing model includes a three-layer multi-layer perceptron, which can realize complex nonlinear mapping and can capture complex patterns and relationships in network traffic data. It is very effective for distinguishing different types of network traffic. At the same time, the network traffic detection model consists of two layers of graph convolutional neural network layers and two layers of activation functions, which utilizes the smoothness assumption of the graph, that is, adjacent nodes have similar characteristics, which helps to achieve smoother and more consistent classification results in network traffic classification, thereby facilitating the discovery of abnormal traffic patterns and achieving more effective and reliable intrusion detection.

[0149] The above descriptions are merely embodiments of the present invention and are not intended to limit the scope of the present invention. Any equivalent transformations made using the contents of the present invention's description and drawings, or directly or indirectly applied in related technical fields, are also included in the scope of the present invention's patent protection.

Claims

1. A network intrusion detection method based on multi-level network traffic information fusion, characterized in that: Including steps: Establish a three-layer multilayer perceptron, each layer of which includes a linear function and a BatchNorm function; Generate a flow graph processing model based on the three-layer multi-layer perceptron; A network traffic detection model is constructed based on two layers of graph convolutional neural network and two layers of activation functions; Generate a two-layer intrusion detection model based on the flow-level graph processing model and the network traffic detection model; Acquiring network traffic data and preprocessing the network traffic data to obtain network flow data; Constructing a data packet timing diagram and a flow association diagram based on the network flow data; Inputting the data packet timing graph into a flow-level graph processing model in a two-layer intrusion detection model, outputting graph representation features of the data packet timing graph, and extracting node features of the flow association graph; Fusing the graph representation feature and the node feature to obtain a new node feature, and inputting the new node feature into a network traffic detection model in a two-layer intrusion detection model to output a detection result; Also includes: Extracting length sequence information and payload information of data packets from the network traffic data; The constructing of a data packet timing diagram and a flow association diagram based on the network flow data includes: Mapping data packets in the network flow data into nodes, normalizing the original bytes in each of the data packets, and storing the normalized bytes as node features in the nodes; Generate edges between the nodes according to the timestamps of the data packets and the order of transmission of the data packets; generating a data packet timing graph according to the nodes and the edges, and storing the length sequence information and the payload information as meta-features in a global attribute of the data packet timing graph; Constructing a bipartite graph according to the network flow data, wherein the bipartite graph includes a source node set, a target node set, and an edge set; Constructing virtual nodes according to the number of source nodes in the source node set and the number of target nodes in the target node set, and adding the virtual nodes to the bipartite graph based on a node random mapping mechanism; Converting the bipartite graph into a line graph according to line graph theory, and using the line graph as a flow association graph; The step of inputting the data packet timing diagram into the flow-level graph processing model in the two-layer intrusion detection model and outputting the graph representation features of the data packet timing diagram includes: ； Where, a graph representing said packet timing diagram, represents the connection operation in the neural network, represents the feature vector of node v at the kth iteration, Represents the set of all nodes, and K represents the total number of iterations.

2. A network intrusion detection method based on multi-level network traffic information fusion according to claim 1, characterized in that: The network traffic data includes a network quintuple; The preprocessing of the network traffic data to obtain the network flow data includes: Eliminating missing values ​​and outliers in the network traffic data to obtain eliminated network traffic data; Extracting a plurality of data packets from the eliminated network traffic data as filtered network traffic data; Sorting the filtered network traffic data according to time series to obtain sorted network traffic data; Converting the network quintuples in the sorted network traffic data into network triples to obtain converted network traffic data, and performing data cleaning on the converted network traffic data to obtain cleaned network traffic data; Normalizing the information in the cleaned network traffic data to obtain normalized information; A network traffic processing method is used to generate network flow data based on the normalized information.

3. A network intrusion detection terminal based on multi-level network traffic information fusion, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the following steps are implemented: Establish a three-layer multilayer perceptron, each layer of which includes a linear function and a BatchNorm function; Generate a flow graph processing model based on the three-layer multi-layer perceptron; A network traffic detection model is constructed based on two layers of graph convolutional neural network and two layers of activation functions; Generate a two-layer intrusion detection model based on the flow-level graph processing model and the network traffic detection model; Acquiring network traffic data and preprocessing the network traffic data to obtain network flow data; Constructing a data packet timing diagram and a flow association diagram based on the network flow data; Inputting the data packet timing graph into a flow-level graph processing model in a two-layer intrusion detection model, outputting graph representation features of the data packet timing graph, and extracting node features of the flow association graph; Fusing the graph representation feature and the node feature to obtain a new node feature, and inputting the new node feature into a network traffic detection model in a two-layer intrusion detection model to output a detection result; Also includes: Extracting length sequence information and payload information of data packets from the network traffic data; The constructing of a data packet timing diagram and a flow association diagram based on the network flow data includes: Mapping data packets in the network flow data into nodes, normalizing the original bytes in each of the data packets, and storing the normalized bytes as node features in the nodes; Generate edges between the nodes according to the timestamps of the data packets and the order of transmission of the data packets; generating a data packet timing graph according to the nodes and the edges, and storing the length sequence information and the payload information as meta-features in a global attribute of the data packet timing graph; Constructing a bipartite graph according to the network flow data, wherein the bipartite graph includes a source node set, a target node set, and an edge set; Constructing virtual nodes according to the number of source nodes in the source node set and the number of target nodes in the target node set, and adding the virtual nodes to the bipartite graph based on a node random mapping mechanism; Converting the bipartite graph into a line graph according to line graph theory, and using the line graph as a flow association graph; The step of inputting the data packet timing diagram into the flow-level graph processing model in the two-layer intrusion detection model and outputting the graph representation features of the data packet timing diagram includes: ； Where, a graph representing said packet timing diagram, represents the connection operation in the neural network, represents the feature vector of node v at the kth iteration, Represents the set of all nodes, and K represents the total number of iterations.

4. A network intrusion detection terminal based on multi-level network traffic information fusion according to claim 3, characterized in that: The network traffic data includes a network quintuple; The preprocessing of the network traffic data to obtain the network flow data includes: Eliminating missing values ​​and outliers in the network traffic data to obtain eliminated network traffic data; Extracting a plurality of data packets from the eliminated network traffic data as filtered network traffic data; Sorting the filtered network traffic data according to time series to obtain sorted network traffic data; Converting the network quintuples in the sorted network traffic data into network triples to obtain converted network traffic data, and performing data cleaning on the converted network traffic data to obtain cleaned network traffic data; Normalizing the information in the cleaned network traffic data to obtain normalized information; A network traffic processing method is used to generate network flow data based on the normalized information.

Images