A malicious traffic detection method based on homogeneous node heterogeneous spectrum fusion graph network

Abstract

The present invention discloses a malicious traffic detection method based on a homogeneous node heterogeneous spectrum fusion graph network, which relates to the field of network security technology, including: obtaining a web page data set, building a malicious traffic detection model, inputting the web page data set into a trained malicious traffic detection model, and obtaining web page nodes accessed by malicious traffic. The present invention maps the complex web page malicious traffic detection problem into a node classification problem in a graph convolutional neural network by combining a graph network, captures the complex relationship between nodes in a web page, and can dynamically update when the web page node topology graph structure changes, thereby improving the accuracy of malicious traffic prediction.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a malicious traffic detection method based on a homogeneous node heterogeneous spectrum fusion graph network. Background Art

[0002] In the field of network security, traditional malicious traffic detection methods are usually divided into many forms, but they are mainly divided into two types: feature-based detection methods and behavior analysis-based detection methods. Feature-based detection methods detect malicious traffic by defining a series of features or rules. These features can be specific codes of malware or common behavior patterns in network attacks. This method is fast and effective for detecting known threats, but it is heavily dependent on the attack data feature database, which greatly limits its usage scenarios; behavior analysis-based detection methods detect malicious traffic by monitoring the behavior patterns of network traffic. This method does not rely on specific rules or features, but judges whether it is malicious traffic by analyzing the statistical characteristics of traffic, the relationship between traffic, etc. It can have good adaptability to new types of malicious traffic, but its disadvantage is that there may be misjudgments, and the algorithm needs to be further optimized. Many researchers have proposed models based on machine learning technology. However, due to inappropriate feature selection, some machine learning models are prone to misclassify most malicious traffic. Therefore, how to select effective features to achieve accurate detection of malicious traffic in the network needs in-depth research. To solve this problem, Muhammmad et al. proposed a new framework model. Firstly, a new feature selection metric method named CorAUC is introduced. Then, based on CorAUC, a new feature selection algorithm based on packaging technology is developed and designed, which can accurately filter features and select effective features for the selected machine learning algorithm by using the area under the curve (AUC) metric. Finally, the comprehensive TOPSIS and Shannon entropy methods based on bijective soft sets are applied to verify the effectiveness of the selected features in the network for malicious traffic identification. In recent years, graph networks have gradually appeared in people's field of vision and can effectively represent and analyze various complex relationships and are applied in various fields. In real network access, the access between web pages is realized through hyperlinks. Each web page can be regarded as a node in the graph network, and the hyperlinks between web pages can be regarded as edges in the graph network. Therefore, the complex web page malicious traffic detection problem can be mapped to the node classification problem in the graph convolutional neural network. Traditional malicious traffic detection methods train models based on a single web page without considering the complex network relationships and dynamic characteristics, which seriously affects the detection accuracy. However, graph networks can capture the complex relationships between nodes in web pages, so that they can be dynamically updated when the topological structure of web page nodes changes, thereby improving the accuracy of malicious traffic prediction. Therefore, how to apply graph networks in malicious traffic detection is an urgent problem to be solved in network security methods. Summary of the invention

[0003] In order to solve the above technical problems, the present invention proposes a malicious traffic detection method based on a homogeneous node heterogeneous spectrum fusion graph network. By combining the graph network method, a malicious traffic detection model is proposed to achieve accurate and efficient detection of malicious traffic in web page access.

[0004] To achieve the above objectives, the present invention provides a malicious traffic detection method based on a homogeneous node heterogeneous spectrum fusion graph network, including: obtaining a web page data set, constructing a malicious traffic detection model, inputting the web page data set into a trained malicious traffic detection model, and obtaining the web page nodes accessed by the malicious traffic.

[0005] According to the malicious traffic detection method based on a homogeneous node heterogeneous spectrum fusion graph network provided by the present invention, the web page data set includes a web page node source data set and a web page node normal traffic data set.

[0006] According to the malicious traffic detection method based on the homogeneous node heterogeneous spectrum fusion graph network provided by the present invention, a malicious traffic detection model is constructed, and the web page node source data set and the web page node normal traffic data set are input into the trained malicious traffic detection model. The method for obtaining the web page nodes accessed by malicious traffic includes:

[0007] Construct a heterogeneous web page graph network based on the hyperlink relationship between web pages to obtain a web page node graph network;

[0008] Based on the web page node graph network, a web page homogeneous node extraction module is constructed to obtain a homogeneous node list of the web page;

[0009] Based on the webpage node graph network, a webpage node spectrum information learning module is constructed to obtain low-frequency information and high-frequency information of webpage nodes;

[0010] Based on the low-frequency information of the webpage nodes, the high-frequency information of the webpage nodes and the homogeneous node list of the webpage, a frequency-quality information fusion model is constructed;

[0011] The frequency-quality information fusion model is trained by combining the webpage node source data set and the webpage node normal traffic data set to obtain a trained frequency-quality information fusion model;

[0012] Acquire source data of the web page node to be tested, input the source data of the web page node to be tested into the trained frequency-quality information fusion model, and obtain traffic prediction data of the web page node to be tested;

[0013] Compare the actual traffic data of the web page node to be tested with the predicted traffic data of the web page node to be tested. If the difference between the actual traffic data of the web page node to be tested and the predicted traffic data of the web page node to be tested is greater than a preset threshold, it is preliminarily determined that the web page is accessed by malicious traffic, and the web page node determined to be accessed by malicious traffic is output.

[0014] According to the malicious traffic detection method based on homogeneous node heterogeneous spectrum fusion graph network provided by the present invention, the web page homogeneous node extraction module includes a web page node topology structure adaptive learning unit and a homogeneous node extraction unit;

[0015] The webpage node topology structure adaptive learning unit is used to obtain the initial structure embedding information of the webpage node through the webpage node topology structure adaptive learning and perform feedback optimization through the loss function;

[0016] The homogeneous node extraction unit is used to extract web page nodes after feedback optimization to obtain a homogeneous node list of the web page.

[0017] According to the malicious traffic detection method based on homogeneous node heterogeneous spectrum fusion graph network provided by the present invention, the loss function acquisition method in the web page node topology structure adaptive learning unit is:

[0018]

[0019] Among them, N represents the total number of nodes, L is the total number of convolution layers and is a hyperparameter, and f (L) [i] represents the final predicted category of node i, represents the true category of node i.

[0020] According to the malicious traffic detection method based on homogeneous node heterogeneous spectrum fusion graph network provided by the present invention, the method for obtaining the homogeneous node list of the web page in the homogeneous node extraction unit is:

[0021] By calculating the dot product between node representations, we get the similarity measure between nodes, which is calculated as follows:

[0022] D i，j =f (L) [i] T ·f (L) [j],

[0023]

[0024] Among them, S represents the sampling node, the number of sampling nodes is m, represents the similarity measure between node i and node j1;

[0025] Get the most similar M for each node homo Nodes:

[0026]

[0027] Build M homo Node and M heter The edge index of the node gets the homogeneity graph A of the node o , calculated as follows:

[0028]

[0029] According to the malicious traffic detection method based on the homogeneous node heterogeneous spectrum fusion graph network provided by the present invention, the method for obtaining the low-frequency information of the web page node and the high-frequency information of the web page node includes:

[0030] A low-frequency filter and a high-frequency filter are designed to aggregate the low-frequency signals and high-frequency signals of the neighbors of the web page node, and the initial residual connection is combined to extract the multi-hop neighbor node information with richer information to obtain the low-frequency information of the web page node and the high-frequency information of the web page node.

[0031] According to the malicious traffic detection method based on the homogeneous node heterogeneous spectrum fusion graph network provided by the present invention, the method for constructing the frequency-quality information fusion model includes:

[0032] The local neighbor information of the node is used to generate the frequency-quality information fusion coefficient, and the homogeneous node list, the low-frequency information of the web page node and the high-frequency information of the web page node are fused and learned to obtain the web page node feature information matrix. The index of the maximum value of each row vector is obtained based on the web page node information matrix. The index of the maximum value of each row vector is the web page node access traffic prediction category. The web page node access traffic prediction category is output to complete the construction of the frequency-quality information fusion model.

[0033] Technical effect of the invention: The present invention discloses a malicious traffic detection method based on a homogeneous node heterogeneous spectrum fusion graph network. By combining the graph network, the complex web page malicious traffic detection problem is mapped into a node classification problem in a graph convolutional neural network, and the complex relationship between nodes in the web page is captured, so that it can be dynamically updated when the web page node topology graph structure changes, thereby improving the accuracy of malicious traffic prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0035] Figure 1 It is a flow chart of a malicious traffic detection method based on a homogeneous node heterogeneous spectrum fusion graph network according to an embodiment of the present invention;

[0036] Figure 2 This is a schematic diagram of adaptive learning of a web page node topology structure according to an embodiment of the present invention;

[0037] Figure 3 This is a schematic diagram of a spectrum information learning module according to an embodiment of the present invention;

[0038] Figure 4 Schematic diagram of a frequency-quality information fusion model according to an embodiment of the present invention. DETAILED DESCRIPTION

[0039] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0040] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0041] like Figure 1 As shown, this embodiment provides a malicious traffic detection method based on a homogeneous node heterogeneous spectrum fusion graph network, including:

[0042] Acquire a web page data set, wherein the web page data set includes: a web page node source data set and a web page node normal flow data set;

[0043] Based on the hyperlink relationship between web pages, a heterogeneous web page graph network is constructed to obtain a web page node graph network;

[0044] Based on the web page node graph network, a web page homogeneous node extraction module is constructed to obtain a list of homogeneous nodes A on the web page. o ;

[0045] Based on the web page node graph network, a web page node spectrum information learning module is constructed to obtain the low-frequency information of web page nodes. and high-frequency information of web page nodes

[0046] Based on low-frequency information of web page nodes High-frequency information of web page nodes and the homogeneous node list of web pages, and build a frequency-quality information fusion model;

[0047] The frequency-quality information fusion model is trained by combining the webpage node source data set and the webpage node normal traffic data set to obtain a trained frequency-quality information fusion model;

[0048] Obtain source data of the web page node to be tested, input the source data of the web page node to be tested into the trained frequency-quality information fusion model, and obtain traffic prediction data of the web page node to be tested;

[0049] Compare the actual traffic data of the web page node to be tested with the predicted traffic data of the web page node to be tested. If the difference between the actual traffic data of the web page node to be tested and the predicted traffic data of the web page node to be tested is greater than the preset threshold, it is preliminarily determined that the web page is accessed by malicious traffic, and finally the web page node determined to be accessed by malicious traffic is output.

[0050] Furthermore, based on the web page node graph network, a web page homogeneous node extraction module is constructed to obtain a homogeneous node list A of the web page o The methods include:

[0051] The construction of the web page homogeneous node extraction module mainly includes two key steps: the web page node topology structure adaptive learning unit and the homogeneous node extraction unit; through the web page node topology structure adaptive learning, the initial structure embedding information of the web page node is obtained and feedback optimization is performed through the loss function; then the web page nodes are extracted to obtain the web page homogeneous node list A o .

[0052] Furthermore, the adaptive learning process of the web page node topology structure in the web page homogeneous node extraction module includes:

[0053] Construct a web page node topology adaptive learning unit and use the web page node source dataset to train the model.

[0054] Divide the dataset, take squirrel as the source dataset, with a total of 5201 nodes, 217073 edges, and 2089 features for each node. The nodes are divided into five categories based on the average monthly traffic. The training set, validation set, and test set account for 60%, 20%, and 20% of the total dataset respectively by random partitioning.

[0055] Adaptive learning of web node topology through learnable convolutional kernels of fixed size from 1 to Q To adaptively aggregate and learn the features of the central web page node and other web page nodes of order 1 to Q. By dividing the feature representation of web page nodes into channels and learning in different channels, a richer node representation is obtained. Due to the characteristics that web page nodes of the same category in heterogeneous data sets are often not directly connected, the present invention defines that a higher-order web page node is given a larger path weight. Based on the web page node source data set, the preliminary embedded feature information of the web page node is extracted. Figure 2 As shown:

[0056] The feature map is G = {X∈R N×D , A∈R N×N}, A is an adjacency matrix with N nodes, and X is a feature matrix with dimension D. A diagonal matrix is ​​defined as D, whose diagonal values ​​are D i，i =∑ jA i，j , the normalized adjacency matrix is Normalized Laplacian Matrix is a symmetric positive semidefinite matrix with eigenvalues ​​λ between [0,2].

[0057] Combined with feature graphs, adaptive learning of web page node topology is achieved. Channel division is performed on the feature representation of web page nodes. Each source web page node has 2089 features, and each single feature is divided into a channel, with a total of 2089 channels. Based on the fact that web page nodes of the same category in heterogeneous data sets are often not directly connected, it is defined that a higher-order web page node is given a larger path weight.

[0058]

[0059] Among them, C l represents the total number of feature channels of web page nodes, Q l The maximum path length defined when representing layer l, represents the web page node whose path length from node i is q. represents the eigenvalue of channel c when node j is in layer l, are the convolution kernel parameters that need to be learned.

[0060] The loss function is implemented by reducing the cross entropy loss between the predicted category and the true category of the web page node.

[0061]

[0062] Among them, N represents the total number of nodes, L is the total number of convolution layers and is a hyperparameter, and f (L) [i] represents the final predicted category of node i, represents the true category of node i.

[0063] Furthermore, the method process of the homogeneous node extraction unit in the web page homogeneous node extraction module includes:

[0064] By computing the dot product between node representations, we obtain a similarity measure between nodes.

[0065] D i，j =f (L) [i] T ·f (L) [j]

[0066]

[0067] Among them, S represents the sampling node, the number of sampling nodes is m, represents the similarity measure between node i and node j1.

[0068] Get the most similar M for each node homo Nodes:

[0069]

[0070] Build M homo Node and M heter The edge index of the node gets the homogeneity graph A of the node o , calculated as follows:

[0071]

[0072] Furthermore, the method for constructing a webpage node spectrum information learning module includes:

[0073] Design a low frequency filter F L and a high frequency filter F H to aggregate low-frequency signals from neighbors in the same category and high-frequency signals from neighbors in different categories. Figure 3 As shown:

[0074]

[0075] The low frequency filter F L and high frequency filter F H Incorporating initial residual connections (IRDC) to extract more informative multi-hop neighbor node information, the node information that has never been processed is passed from the original input to the next layer, thereby making full use of all the information from the initial node features.

[0076]

[0077] Where k = 2, ..., K, S is a GNN filter, X represents the node feature matrix, and γ is a hyperparameter, γ∈[0, 1]. Then and Through the transformation into z dimension by learnable parameters, we get and

[0078]

[0079] Among them, σ is the ReLU activation function, is a learnable weight matrix.

[0080] Furthermore, the method process of constructing the frequency-quality information fusion model includes:

[0081] Combined with the homogeneous node list Ao of the web page and the low-frequency information of the web page nodes and high-frequency information of web page nodes The local neighbor information of the node is used to generate the frequency-quality information fusion coefficient, and the node representation that aggregates the global node features is obtained for subsequent classification. Figure 4 As shown:

[0082]

[0083] [α_Ao, α_L, α_H] = MLP α ([Φ,Φ 2 ])

[0084] Among them, sim(.,.) is the similarity measure, N i Represents the neighbor nodes of node i.

[0085] The node information of the homogeneous node list Ao obtained by the web page homogeneous node extraction module is combined with the low-frequency information of the web page nodes obtained by the web page node spectrum information learning module and high-frequency information of web page nodes Perform fusion learning to obtain the node representation Z.

[0086] H Ao =Linear(MPConv(Ao, X))

[0087]

[0088] Z=W out Z K , Z i = Z[i]

[0089] Where k = 1, 2, ..., K. X represents the node feature matrix, W out is the learnable weight matrix, Z i Represents the monthly traffic forecast data of web page node i.

[0090] In this embodiment, the actual monthly traffic data of the web page node to be tested is compared And the monthly traffic forecast data Z of the web page node to be tested i If the actual traffic data of the web page node is much larger than the predicted data of the web page node, it is preliminarily determined that the web page is accessed by malicious traffic, and the web page node determined to be accessed by malicious traffic is finally output.

[0091] The malicious traffic detection model designed by the present invention adopts accuracy, an important indicator, as a performance indicator for judging the malicious traffic detection model based on a heterogeneous graph network.

[0092] This embodiment proposes a malicious traffic detection method based on a homogeneous node heterogeneous spectrum fusion graph network. The method uses the public dataset squirrel as the source dataset and the target dataset. By introducing a graph network model, the graph network can capture the complex relationship between nodes in the network, so that it can be dynamically updated when the network node topology structure changes, thereby improving the accuracy of malicious traffic prediction.

[0093] The above are only preferred specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A malicious traffic detection method based on a homogeneous node heterogeneous spectrum fusion graph network, characterized in that: include: Obtain a web page data set, build a malicious traffic detection model, input the web page data set into the trained malicious traffic detection model, and obtain web page nodes accessed by malicious traffic; The web page data set includes a web page node source data set and a web page node normal flow data set; The method of constructing a malicious traffic detection model, inputting the web page node source data set and the web page node normal traffic data set into the trained malicious traffic detection model, and obtaining the web page nodes accessed by malicious traffic includes: Construct a heterogeneous web page graph network based on the hyperlink relationship between web pages to obtain a web page node graph network; Based on the web page node graph network, a web page homogeneous node extraction module is constructed to obtain a homogeneous node list of the web page; Based on the webpage node graph network, a webpage node spectrum information learning module is constructed to obtain low-frequency information and high-frequency information of webpage nodes; Based on the low-frequency information of the webpage nodes, the high-frequency information of the webpage nodes and the homogeneous node list of the webpage, a frequency-quality information fusion model is constructed; The frequency-quality information fusion model is trained by combining the webpage node source data set and the webpage node normal traffic data set to obtain a trained frequency-quality information fusion model; Acquire source data of the web page node to be tested, input the source data of the web page node to be tested into the trained frequency-quality information fusion model, and obtain traffic prediction data of the web page node to be tested; Compare the actual traffic data of the web page node to be tested with the predicted traffic data of the web page node to be tested. If the difference between the actual traffic data of the web page node to be tested and the predicted traffic data of the web page node to be tested is greater than a preset threshold, it is preliminarily determined that the web page is accessed by malicious traffic, and the web page node determined to be accessed by malicious traffic is output.

2. The malicious traffic detection method based on a homogeneous node heterogeneous spectrum fusion graph network as claimed in claim 1 is characterized in that: The web page homogeneous node extraction module includes a web page node topology structure adaptive learning unit and a homogeneous node extraction unit; The webpage node topology structure adaptive learning unit is used to obtain the initial structure embedding information of the webpage node through the webpage node topology structure adaptive learning and perform feedback optimization through the loss function; The homogeneous node extraction unit is used to extract web page nodes after feedback optimization to obtain a homogeneous node list of the web page.

3. The malicious traffic detection method based on a homogeneous node heterogeneous spectrum fusion graph network as described in claim 2 is characterized in that: The method for obtaining the loss function in the webpage node topology structure adaptive learning unit is: Among them, N represents the total number of nodes, L is the total number of convolution layers and is a hyperparameter, and f (L) [i] represents the final predicted category of node i, represents the true category of node i.

4. The malicious traffic detection method based on a homogeneous node heterogeneous spectrum fusion graph network as described in claim 2 is characterized in that: The method for obtaining the homogeneous node list of a web page in the homogeneous node extraction unit is: By calculating the dot product between node representations, we get the similarity measure between nodes, which is calculated as follows: D i，j =f (L) [i] T ·f (L) [j], Among them, S represents the sampling node, the number of sampling nodes is m, represents the similarity measure between node i and node j1; Get the most similar M for each node homo Nodes: Build M homo Node and M heter The edge index of the node gets the homogeneity graph A of the node o , calculated as follows:

5. The malicious traffic detection method based on a homogeneous node heterogeneous spectrum fusion graph network as claimed in claim 1 is characterized in that: The method for obtaining low-frequency information and high-frequency information of web page nodes includes: A low-frequency filter and a high-frequency filter are designed to aggregate the low-frequency signals and high-frequency signals of the neighbors of the web page node, and the initial residual connection is combined to extract the multi-hop neighbor node information with richer information to obtain the low-frequency information of the web page node and the high-frequency information of the web page node.

6. The malicious traffic detection method based on a homogeneous node heterogeneous spectrum fusion graph network as claimed in claim 1 is characterized in that: Methods for constructing a frequency-quality information fusion model include: The local neighbor information of the node is used to generate the frequency-quality information fusion coefficient, and the homogeneous node list, the low-frequency information of the web page node and the high-frequency information of the web page node are fused and learned to obtain the web page node feature information matrix. The index of the maximum value of each row vector is obtained based on the web page node information matrix. The index of the maximum value of each row vector is the web page node access traffic prediction category. The web page node access traffic prediction category is output to complete the construction of the frequency-quality information fusion model.

Images