Malicious encrypted traffic detection method based on heterogeneous graph attention network and random walk

Abstract

A malicious encrypted traffic detection method based on heterogeneous graph attention network and random walk, relating to the field of network security technology, uses a meta-path-based random walk strategy to obtain neighboring nodes that are closer in time to each node in different meta-paths, and adopts a heterogeneous graph attention network to achieve node-level and meta-path-level information aggregation and feature embedding, so as to capture potential spatial structure information and temporal associations in encrypted traffic.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a malicious encrypted traffic detection method based on heterogeneous graph attention network and random walk. Background Art

[0002] With the rapid development of the Internet, malicious traffic identification has become an important task in cyberspace security and network management. In order to ensure the security of data information during transmission, more and more network traffic is transmitted in an encrypted manner. While providing traffic privacy and data protection, encrypted traffic also creates certain risks. As an important carrier of network attacks and network threats, many criminals use encryption protocols to encapsulate malicious traffic and hide bad intentions in order to bypass network firewalls and avoid intrusion detection. However, this brings huge challenges to cyberspace security monitoring and defense against network attacks.

[0003] At present, researchers have proposed a variety of methods, such as traditional payload-based deep packet inspection (DPI) methods that match keywords in packets with fixed rules, which are very effective for unencrypted traffic. However, their accuracy is significantly reduced when processing encrypted payloads. Subsequently, machine learning-based methods have been widely used to identify encrypted traffic. However, these methods require manual feature extraction, which is not only time-consuming but also lacks the flexibility required to adapt to changing threats. With the advancement of neural networks, deep learning-based methods, such as convolutional neural networks (CNNs) and recurrent neural networks (RNNs), have been increasingly applied to analyze malicious encrypted network traffic. These models convert input data into fixed-length vectors and apply learned feature detectors. However, this conversion process of mapping data to Euclidean space often ignores the complex relationships between packets in network traffic, thereby losing potentially valuable information. Therefore, recent studies have adopted the method of graph neural network (GNN) to model network traffic as a graph to capture the relationships between nodes. GNN captures the complex relationships between nodes by modeling network traffic as a graph. Most existing GNN-based methods build graphs based on packet correlations. The network contains only a single node type, and it is difficult to model the complex interdependencies between heterogeneous network objects (e.g., ports, protocols). Summary of the invention

[0004] In order to overcome the shortcomings of the above technologies, the present invention provides a malicious encrypted traffic detection method based on heterogeneous graph attention network and random walk, which captures the potential spatial structure information and temporal correlation in encrypted traffic and improves the accuracy of model detection.

[0005] The technical solution adopted by the present invention to overcome the technical problems is:

[0006] A malicious encrypted traffic detection method based on heterogeneous graph attention network and random walk, comprising:

[0007] (a) Establishing an initial dataset consisting of encrypted traffic data ;

[0008] (b) For the initial dataset Split by session to get the split data set , ,in For the Sessions, , is the number of sessions;

[0009] (c) Based on the segmented data set Build the CSV file;

[0010] (d) Constructing a heterogeneous graph based on CSV files and meta-path collection ;

[0011] (e) Using Meta-Path Collection Execute the random walk algorithm to obtain the updated adjacency matrix;

[0012] (f) Establish a heterogeneous graph attention model, input the updated adjacency matrix into the heterogeneous graph attention model, and output the final embedding representation ;

[0013] (g) According to the final embedding representation The probability distribution of 0 and 1 is obtained, where 0 indicates malicious traffic and 1 indicates benign traffic.

[0014] Furthermore, in step (a), the rdpcap() function of the Python scapy toolkit is used to load all the data packets in the PCAP file in the public dataset to obtain the initial dataset. .

[0015] Furthermore, in step (b), the initial data set is parsed using Python’s scapy toolkit , the initial data set Split by session to get the split data set , No. Sessions , For the of the sessions Data packets, , For the The number of packets in a session.

[0016] Further, step (c) comprises the following steps:

[0017] (c-1) Use Python's scapy toolkit to parse the segmented data set The Sessions , will Sessions The data packets, IP protocols, protocols, and port numbers in the graph are used as nodes for graph construction;

[0018] (c-2) Extraction Sessions Source MAC, destination MAC, packet length, payload length, IP, UDP length, ttl time, timestamp, Sessions Middle Packets With Packets The time difference is taken as the feature vector of the node;

[0019] (c-3) of the sessions Packets The term used to identify whether the data packet is malicious traffic is labels;

[0020] (c-4) Create a DataFrame table. Behavior of the sessions Data packets, ,The columns of the DataFrame table are nodes, data packet node feature information, and labels;

[0021] (c-5) Use the pandas library to convert the DataFrame table into a CSV file.

[0022] Further, step (d) comprises the following steps:

[0023] (d-1) Use the NetworkX library in Python to create a directed graph using the nodes in the CSV file , ,in is a node set, is the edge set, , For the nodes, , is the number of nodes, , For the Strip edge, , is the number of edges, the edge set There are Similarity edges, , create a vector containing 256 elements, initialize each element in the vector to zero, and traverse the first Sessions Middle Packets For each byte in the data packet, each element of the vector is the number of times the corresponding byte value appears in the data packet, resulting in a 256-dimensional frequency vector ; Create a vector containing 256 elements, initialize each element in the vector to zero, and traverse the first Sessions Middle Packets For each byte in the data packet, each element of the vector is the number of times the corresponding byte value appears in the data packet, resulting in a 256-dimensional frequency vector , calculate the frequency vector With the frequency vector The cosine similarity between , when the cosine similarity When it is greater than the threshold, the directed graph Add a similarity edge to

[0024] (d-2) Use the NetworkX library in Python to convert the directed graph Convert to heterogeneous graph supported by DGL library ;

[0025] (d-3) Meta-path collection , For the Seed path, , the first meta-path The second metapath is: data packet-protocol-data packet The third meta-path is: data packet-port number-data packet The fourth meta-path is: data packet-similarity edge-data packet It is: data packet-IP-data packet.

[0026] Preferably, the threshold value is 0.9.

[0027] Further, step (e) comprises the following steps:

[0028] (e-1) Seed Path Create an adjacency matrix , , if of the sessions Packets With of the sessions Packets The relationship between them conforms to the meta-path , then the adjacency matrix Middle Line The value of the column is set to 1 if the of the sessions Packets With of the sessions Packets The relationship between , then the adjacency matrix Middle Line The value of the column is set to 0;

[0029] (e-2) Select and Nodes The relationship conforms to the meta-path Potential neighbor nodes , through the formula Calculate the first Nodes With potential neighbor nodes The weight between , where is the adjustment coefficient, For the Nodes With potential neighbor nodes The time difference between is an absolute value;

[0030] (e-3) by formula Calculate the first Nodes To potential neighbor nodes The transition probability , For the Nodes Relations conform to meta-paths Potential neighbor nodes of For the Nodes The relationship conforms to the meta-path The set of potential neighbor nodes of Potential neighbor nodes With Nodes The weight between , For the Nodes With potential neighbor nodes The time difference between Greater than threshold When the potential neighbor nodes Add to the neighbor node set;

[0031] (e-4) Check potential neighbor nodes Is it in the neighbor node set? If not, add it to the neighbor node set and repeat step (e-3) until the neighbor nodes in the neighbor node set reach indivual;

[0032] (e-5) If the first Neighbor nodes If exists, then the adjacency matrix Middle Line The value of the column is set to 1 and the Line The column value is set to 1 to get the updated adjacency matrix .

[0033] Further, step (f) comprises the following steps:

[0034] (f-1) The heterogeneous graph attention model consists of a node-level attention module and a semantic-level attention module. The node-level attention module consists of a feedforward neural network, a normalization unit, and an aggregation unit. The semantic-level attention module consists of an importance unit, a weight unit, and an aggregation unit.

[0035] (f-2) Establish the change matrix , is the number of eigenvectors of the node, through the formula Calculate the new eigenvector , where For the Nodes The eigenvector of Calculate the new eigenvector , where Potential neighbor nodes The eigenvector of

[0036] (f-3) The new eigenvector , the new feature vector , the updated adjacency matrix Input into the feedforward neural network of the node-level attention module, and output the potential neighbor nodes For Nodes Importance index ;

[0037] (f-4) Importance index Input to the normalization unit of the node-level attention module for normalization to obtain the weight coefficient ;

[0038] (f-5) The weight coefficient Input into the aggregation unit of the node-level attention module, through the formula Calculate the first Nodes Meta-path based The aggregate value of the feature map vector and weight coefficient of the node neighbors , is the Sigmoid activation function, The aggregate value of each node constitutes the meta-path Aggregate value set , , the aggregate value set of the four meta-paths is ;

[0039] (f-6) Aggregate value Input into the importance unit of the semantic level attention module, through the formula Calculate the importance index , where is the semantic level attention vector, For transposition, is the tanh function, is the weight matrix, is the bias vector;

[0040] (f-7) Importance index Input into the weight unit of the semantic level attention module, through the formula Calculate the meta-path Weight ;

[0041] (f-8) weight Input into the aggregation unit of the semantic level attention module, through the formula Calculate the final embedding representation .

[0042] Furthermore, in step (g), the final embedding representation is It is input into the multi-layer perceptron MLP, the fully connected layer, and the Sigmoid function in sequence, and the output is a probability distribution of 0, 1.

[0043] Furthermore, it also includes using the Adam optimizer to train the heterogeneous graph attention model using a cross entropy loss function to obtain an optimized heterogeneous graph attention model.

[0044] The beneficial effects of the present invention are as follows: by modeling the encrypted traffic data using a heterogeneous graph, the relationship between nodes is established, and a heterogeneous graph attention network is used to learn node-level and meta-path-level embedding. At the same time, the model uses a meta-path-based random walk strategy to capture the hidden temporal features and spatial structure information in the encrypted traffic, further improving the accuracy of model detection. Through deep learning technology, malicious encrypted traffic is detected. The proposed method can capture the relationship between nodes, which helps to identify malicious activities in the network and protect the security of users and systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 The present invention is a flow chart of the method. DETAILED DESCRIPTION

[0046] The following is combined with Figure 1 The present invention is further described.

[0047] A malicious encrypted traffic detection method based on heterogeneous graph attention network and random walk, comprising:

[0048] (a) Establishing an initial dataset consisting of encrypted traffic data .

[0049] (b) For the initial dataset Split by session to get the split data set , ,in For the Sessions, , is the number of sessions.

[0050] (c) Based on the segmented data set Construct the CSV file.

[0051] (d) Constructing a heterogeneous graph based on CSV files and meta-path collection .

[0052] (e) Using Meta-Path Collection Execute the random walk algorithm to obtain the updated adjacency matrix.

[0053] (f) Establish a heterogeneous graph attention model, input the updated adjacency matrix into the heterogeneous graph attention model, and output the final embedding representation The heterogeneous graph attention network uses a two-layer attention mechanism to assign different weights to the node level and meta-path level, thereby being able to capture the complex relationships and interaction patterns between nodes.

[0054] (g) According to the final embedding representation The probability distribution of 0 and 1 is obtained. When it is 0, it indicates malicious traffic, and when it is 1, it indicates benign traffic, thus achieving the final classification of malicious encrypted traffic.

[0055] A meta-path-based random walk strategy is used to obtain the temporally closer neighbor nodes of each node in different meta-paths, and a heterogeneous graph attention network is adopted to realize node-level and meta-path-level information aggregation and feature embedding to capture the potential spatial structure information and temporal correlation in encrypted traffic.

[0056] In one embodiment of the present invention, in step (a), the rdpcap() function of the Python scapy toolkit is used to load all the data packets in the PCAP file in the public data set to obtain the initial data set. .

[0057] In one embodiment of the present invention, step (b) uses Python's scapy toolkit to parse the initial data set. , the initial data set Split by session to get the split data set , No. Sessions , For the of the sessions Data packets, , For the The number of packets in a session. Each session consists of a two-way flow of communication from the same source address to the same destination.

[0058] In one embodiment of the present invention, step (c) comprises the following steps:

[0059] (c-1) Use Python's scapy toolkit to parse the segmented data set The Sessions , will Sessions The data packets, IP protocols, protocols, and port numbers in are used as nodes for graph construction.

[0060] (c-2) Extraction Sessions Source MAC, destination MAC, packet length, payload length, IP, UDP length, ttl time, timestamp, Sessions Middle Packets With Packets The time difference is taken as the feature vector of the node.

[0061] (c-3) of the sessions Packets The labels used to identify whether the data packet is malicious traffic are labels.

[0062] (c-4) Create a DataFrame table. Behavior of the sessions Data packets, ,The columns of the DataFrame table are nodes, data packet node feature information, and labels.

[0063] (c-5) Use the pandas library to convert the DataFrame table into a CSV file to facilitate the subsequent heterogeneous graph construction at the data storage level.

[0064] In one embodiment of the present invention, step (d) comprises the following steps:

[0065] (d-1) Use the NetworkX library in Python to create a directed graph using the nodes in the CSV file , ,in is a node set, is the edge set, , For the nodes, , is the number of nodes, , For the Strip edge, , is the number of edges, the edge set There are Similarity edges, , create a vector containing 256 elements, initialize each element in the vector to zero, and traverse the first Sessions Middle Packets For each byte in the data packet, each element of the vector is the number of times the corresponding byte value appears in the data packet, resulting in a 256-dimensional frequency vector ; Create a vector containing 256 elements, initialize each element in the vector to zero, and traverse the first Sessions Middle Packets For each byte in the data packet, each element of the vector is the number of times the corresponding byte value appears in the data packet, resulting in a 256-dimensional frequency vector , calculate the frequency vector With the frequency vector The cosine similarity between , the similarity value ranges from -1 (completely dissimilar) to 1 (completely similar). When it is greater than the threshold, the directed graph Add a similarity edge to .

[0066] (d-2) In order to process large-scale data and perform heterogeneous graph neural networks, the NetworkX library in Python is used to convert directed graphs Convert to heterogeneous graph supported by DGL library .

[0067] (d-3) In order to analyze and identify malicious traffic in network traffic, four types of meta-paths are designed. The meta-path set , For the Seed path, , the first meta-path The second metapath is: data packet-protocol-data packet The third meta-path is: data packet-port number-data packet The fourth meta-path is: data packet-similarity edge-data packet It is: data packet-IP-data packet.

[0068] In this embodiment, the threshold value is 0.9.

[0069] In one embodiment of the present invention, step (e) comprises the following steps:

[0070] (e-1) Seed Path Create an adjacency matrix , , if of the sessions Packets With of the sessions Packets The relationship between them conforms to the meta-path , then the adjacency matrix Middle Line The value of the column is set to 1 if the of the sessions Packets With of the sessions Packets The relationship between , then the adjacency matrix Middle Line The values ​​of the columns are set to 0. The adjacency matrix is ​​a sparse matrix, which can effectively represent and store large-scale graph data, especially when the meta-path involves a large number of nodes and edges.

[0071] (e-2) To integrate heterogeneous graphs To explore the correlation between spatial and temporal features in the metapath, a time-skewed random walk algorithm based on metapath is designed. From the node Start with the time tilt function to adjust the transition probability between nodes. Nodes The relationship conforms to the meta-path Potential neighbor nodes , through the formula Calculate the first Nodes With potential neighbor nodes The weight between , where is the adjustment coefficient, For the Nodes With potential neighbor nodes The time difference between is an absolute value.

[0072] (e-3) by formula Calculate the first Nodes To potential neighbor nodes The transition probability , For the Nodes Relations conform to meta-paths Potential neighbor nodes of For the Nodes The relationship conforms to the meta-path The set of potential neighbor nodes of Potential neighbor nodes With Nodes The weight between , For the Nodes With potential neighbor nodes The time difference between Greater than threshold When the potential neighbor nodes Add to the neighbor node set. The selection weight will be calculated based on the time skew function and the timestamp of the neighbor. The weight distribution during the walk is adjusted according to the time skew function, giving priority to paths that are close in time, effectively reflecting the time continuity of the graph.

[0073] (e-4) Check potential neighbor nodes Is it in the neighbor node set? If not, add it to the neighbor node set and repeat step (e-3) until the neighbor nodes in the neighbor node set reach During the random walk, the time tilt strategy gives priority to nodes that are closer to the current node in time. The algorithm can then select neighbor nodes to improve the accuracy of capturing temporal correlations in encrypted traffic. If the wandering probability leads to a restart, the algorithm will restart from the starting node or a newly selected node.

[0074] (e-5) If the first Neighbor nodes If exists, then the adjacency matrix Middle Line The value of the column is set to 1 and the Line The column value is set to 1 to get the updated adjacency matrix .

[0075] In one embodiment of the present invention, step (f) comprises the following steps:

[0076] (f-1) The heterogeneous graph attention model consists of a node-level attention module and a semantic-level attention module. The node-level attention module consists of a feedforward neural network, a normalization unit, and an aggregation unit. The semantic-level attention module consists of an importance unit, a weight unit, and an aggregation unit.

[0077] (f-2) First, we need to map the features of different node types to a unified feature space, so we establish a change matrix , is the number of eigenvectors of the node, through the formula Calculate the new eigenvector , where For the Nodes The eigenvector of Calculate the new eigenvector , where Potential neighbor nodes The feature vector of .

[0078] (f-3) The new eigenvector , the new feature vector , the updated adjacency matrix Input into the feedforward neural network of the node-level attention module, and output the potential neighbor nodes For Nodes Importance index .

[0079] (f-4) Importance index Input to the normalization unit of the node-level attention module for normalization to obtain the weight coefficient .

[0080] (f-5) The weight coefficient Input into the aggregation unit of the node-level attention module, through the formula Calculate the first Nodes Meta-path based The aggregate value of the feature map vector and weight coefficient of the node neighbors , is the Sigmoid activation function, The aggregate value of each node constitutes the meta-path Aggregate value set , , the aggregate value set of the four meta-paths is .

[0081] (f-6) Aggregate value Input into the importance unit of the semantic level attention module, through the formula Calculate the importance index , where is the semantic level attention vector, For transposition, is the tanh function, is the weight matrix, is the bias vector.

[0082] (f-7) Importance index Input into the weight unit of the semantic level attention module, through the formula Calculate the meta-path Weight . Weight The higher the value of, the more important the meta-path is, otherwise it means the lower the importance is.

[0083] (f-8) weight Input into the aggregation unit of the semantic level attention module, through the formula Calculate the final embedding representation .

[0084] In one embodiment of the present invention, the final embedding representation is The input is sequentially fed into the multi-layer perceptron MLP, the fully connected layer, and the Sigmoid function, and the output is a probability distribution of 0,1. The multi-layer perceptron MLP contains multiple fully connected layers, which are connected by nonlinear activation functions to enhance the model's ability to recognize complex data patterns. First, it passes through a fully connected layer, which is equipped with a weight matrix and bias term to transform the input features. Next, the nonlinear activation function ReLU is used to increase the nonlinear processing capability of the model. After the first layer is processed, the output features are fed into the next fully connected layer. This process is repeated in multiple layers, and each layer gradually refines the features through similar fully connected and activated steps.

[0085] In one embodiment of the present invention, it also includes using an Adam optimizer to train the heterogeneous graph attention model using a cross entropy loss function to obtain an optimized heterogeneous graph attention model.

[0086] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A malicious encrypted traffic detection method based on heterogeneous graph attention network and random walk, characterized in that: include: (a) Establishing an initial dataset consisting of encrypted traffic data ; (b) For the initial dataset Split by session to get the split data set , ,in For the Sessions, , is the number of sessions; (c) Based on the segmented data set Build the CSV file; (d) Constructing a heterogeneous graph based on CSV files and meta-path collection ; (e) Using Meta-Path Collection Execute the random walk algorithm to obtain the updated adjacency matrix; (f) Establish a heterogeneous graph attention model, input the updated adjacency matrix into the heterogeneous graph attention model, and output the final embedding representation ; (g) According to the final embedding representation The probability distribution of 0 and 1 is obtained, where 0 indicates malicious traffic and 1 indicates benign traffic; Step (c) comprises the following steps: (c-1) Use Python's scapy toolkit to parse the segmented data set The Sessions , will Sessions The data packets, IP protocols, protocols, and port numbers in the graph are used as nodes for graph construction; (c-2) Extraction Sessions Source MAC, destination MAC, packet length, payload length, IP, UDP length, ttl time, timestamp, Sessions Middle Packets With Packets The time difference is taken as the feature vector of the node; (c-3) of the sessions Packets The term used to identify whether the data packet is malicious traffic is labels; (c-4) Create a DataFrame table. Behavior of the sessions Data packets, ,The columns of the DataFrame table are nodes, data packet node feature information, and labels; (c-5) Use the pandas library to convert the DataFrame table into a CSV file; Step (e) comprises the following steps: (e-1) Seed Path Create an adjacency matrix , , if of the sessions Packets With of the sessions Packets The relationship between them conforms to the meta-path , then the adjacency matrix Middle Line The value of the column is set to 1 if the of the sessions Packets With of the sessions Packets The relationship between , then the adjacency matrix Middle Line The value of the column is set to 0; (e-2) Select and Nodes The relationship conforms to the meta-path Potential neighbor nodes , through the formula Calculate the first Nodes With potential neighbor nodes The weight between , where is the adjustment coefficient, For the Nodes With potential neighbor nodes The time difference between is an absolute value; (e-3) by formula Calculate the first Nodes To potential neighbor nodes The transition probability , For the Nodes Relations conform to meta-paths Potential neighbor nodes of For the Nodes The relationship conforms to the meta-path The set of potential neighbor nodes of Potential neighbor nodes With Nodes The weight between , For the Nodes With potential neighbor nodes The time difference between Greater than threshold When the potential neighbor nodes Add to the neighbor node set; (e-4) Check potential neighbor nodes Is it in the neighbor node set? If not, add it to the neighbor node set and repeat step (e-3) until the neighbor nodes in the neighbor node set reach indivual; (e-5) If the neighbor node Neighbor nodes If exists, then the adjacency matrix Middle Line The value of the column is set to 1 and the Line The column value is set to 1 to get the updated adjacency matrix .

2. The method for detecting malicious encrypted traffic based on heterogeneous graph attention network and random walk according to claim 1 is characterized in that: In step (a), use the rdpcap() function of Python's scapy toolkit to load all the data packets in the PCAP file in the public dataset to obtain the initial dataset. .

3. The malicious encrypted traffic detection method based on heterogeneous graph attention network and random walk according to claim 1 is characterized in that: In step (b), the initial dataset is parsed using Python’s scapy toolkit , the initial data set Split by session to get the split data set , No. Sessions , For the of the sessions Data packets, , For the The number of packets in a session.

4. The method for detecting malicious encrypted traffic based on heterogeneous graph attention network and random walk according to claim 1 is characterized in that: Step (d) comprises the following steps: (d-1) Use the NetworkX library in Python to create a directed graph using the nodes in the CSV file , ,in is a node set, is the edge set, , For the nodes, , is the number of nodes, , For the Strip edge, , is the number of edges, the edge set There are Similarity edges, , create a vector containing 256 elements, initialize each element in the vector to zero, and traverse the first Sessions Middle Packets For each byte in the data packet, each element of the vector is the number of times the corresponding byte value appears in the data packet, resulting in a 256-dimensional frequency vector ; Create a vector containing 256 elements, initialize each element in the vector to zero, and traverse the first Sessions Middle Packets For each byte in the data packet, each element of the vector is the number of times the corresponding byte value appears in the data packet, resulting in a 256-dimensional frequency vector , calculate the frequency vector With the frequency vector The cosine similarity between , when the cosine similarity When it is greater than the threshold, the directed graph Add a similarity edge to (d-2) Use the NetworkX library in Python to convert the directed graph Convert to heterogeneous graph supported by DGL library ; (d-3) Meta-path collection , For the Seed path, , the first meta-path The second metapath is: data packet-protocol-data packet The third meta-path is: data packet-port number-data packet The fourth meta-path is: data packet-similarity edge-data packet It is: data packet-IP-data packet.

5. The method for detecting malicious encrypted traffic based on heterogeneous graph attention network and random walk according to claim 4 is characterized in that: The threshold value is 0.

9.

6. The method for detecting malicious encrypted traffic based on heterogeneous graph attention network and random walk according to claim 1 is characterized in that: Step (f) comprises the following steps: (f-1) The heterogeneous graph attention model consists of a node-level attention module and a semantic-level attention module. The node-level attention module consists of a feedforward neural network, a normalization unit, and an aggregation unit. The semantic-level attention module consists of an importance unit, a weight unit, and an aggregation unit. (f-2) Establish the change matrix , is the number of eigenvectors of the node, through the formula Calculate the new eigenvector , where For the Nodes The eigenvector of Calculate the new eigenvector , where Potential neighbor nodes The eigenvector of (f-3) The new eigenvector , the new feature vector , the updated adjacency matrix Input into the feedforward neural network of the node-level attention module, and output the potential neighbor nodes For Nodes Importance index ; (f-4) Importance index Input to the normalization unit of the node-level attention module for normalization to obtain the weight coefficient ; (f-5) The weight coefficient Input into the aggregation unit of the node-level attention module, through the formula Calculate the first Nodes Meta-path based The aggregate value of the feature map vector and weight coefficient of the node neighbors , is the Sigmoid activation function, The aggregate value of each node constitutes the meta-path Aggregate value set , , the aggregate value set of the four meta-paths is ; (f-6) Aggregate value Input into the importance unit of the semantic level attention module, through the formula Calculate the importance index , where is the semantic level attention vector, For transposition, is the tanh function, is the weight matrix, is the bias vector; (f-7) Importance index Input into the weight unit of the semantic level attention module, through the formula Calculate the meta-path Weight ; (f-8) weight Input into the aggregation unit of the semantic level attention module, through the formula Calculate the final embedding representation .

7. The method for detecting malicious encrypted traffic based on heterogeneous graph attention network and random walk according to claim 1 is characterized in that: In step (g), the final embedding representation is It is input into the multi-layer perceptron MLP, the fully connected layer, and the Sigmoid function in sequence, and the output is a probability distribution of 0, 1.

8. The method for detecting malicious encrypted traffic based on heterogeneous graph attention network and random walk according to claim 1, characterized in that: It also includes using the Adam optimizer to train the heterogeneous graph attention model using the cross entropy loss function to obtain an optimized heterogeneous graph attention model.

Images