A method and apparatus for detecting network node anomalies based on tree neural networks

Abstract

The present invention discloses a method and device for detecting network node anomalies based on a tree neural network, comprising: obtaining network traffic information of a network to be detected within a predetermined time period; constructing a tree structure of the network to be detected based on multiple network nodes of the network to be detected; constructing a tree neural detection model of the network to be detected based on the network traffic information within the predetermined time period and the tree structure; and obtaining network traffic information of the network to be detected at the time to be detected, inputting the information into the tree neural detection model, and detecting network nodes with malicious traffic among the multiple network nodes of the network to be detected.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a method and apparatus for detecting network node anomalies based on a tree neural network. Background Technology

[0002] Traditional methods for detecting malicious traffic are mainly based on network packet feature engineering and rule matching. These methods require manual extraction and selection of features, making it difficult to adapt to different types and dynamic changes in malicious traffic, and they are also vulnerable to adversarial attacks.

[0003] In recent years, deep learning methods have been widely used in malicious traffic detection. Traditional malicious traffic detection methods are mostly based on feature engineering and rule matching, which require manual intervention and cannot effectively identify malicious traffic from constantly changing dynamic networks. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a method and apparatus for anomaly detection of network nodes based on tree neural networks, a method and apparatus for detecting network node anomalies based on tree neural networks, or a method and apparatus for detecting network nodes based on tree neural networks.

[0005] According to one aspect of the present invention, a method for detecting network nodes based on a tree neural network is provided, characterized in that it includes:

[0006] Obtain network traffic information of the network to be tested within a predetermined time period;

[0007] Based on the multiple network nodes of the network to be detected, construct a tree structure of the network to be detected;

[0008] Based on network traffic information within a predetermined time period and the tree structure, a tree neural network detection model for the network to be detected is constructed; and

[0009] The network traffic information of the network to be detected at the time of detection is obtained and input into the tree neural network detection model to detect network nodes with malicious traffic among multiple network nodes of the network to be detected.

[0010] Preferably, the network traffic information includes: inbound traffic of network nodes, outbound traffic of network nodes, protocol distribution, port distribution, IP address distribution, and bandwidth utilization.

[0011] Preferably, constructing a tree structure for the network to be detected based on multiple network nodes includes:

[0012] The multiple network nodes of the network to be detected are abstracted into a tree structure with M layers, wherein the tree structure includes: the root node, intermediate nodes and leaf nodes of the tree, the root node is a router or data aggregation device, the intermediate nodes and leaf nodes are network nodes connected to the router or data aggregation device, and M is greater than or equal to 2.

[0013] The root node is located in layer 1.

[0014] Preferably, the tree adjacency matrix of the tree structure is represented as:

[0015]

[0016] Where, if network node i and network node j are communicating at the current time t, and data is sent from network node i to network node j, the direction of the data flow at the current time t is represented as follows: point to Then network node i is the parent node of network node j, A ij =1, Represents the network node i at the current moment. Represents network node j at time t.

[0017] If network node i and network node j do not have data communication at the current time t, then A i,j =0 represents the network node at the current time, and represents the network node at the current time t;

[0018] Here, the current time t corresponds to a time slice.

[0019] Preferably, based on network traffic information within a predetermined time period and the tree structure, a tree neural network detection model for the network to be detected is constructed, including:

[0020] Starting from the layer where the root node of the tree structure is located, proceeding towards the leaf node of the Mth layer, with a step size of 1 layer, obtain 2 layers at a time and perform calculations until the Mth layer of the tree structure participates in the calculation. Perform the following: Based on the network traffic information within the predetermined time period, calculate the similarity between each child node in each subtree of the tree structure and each of its one or more sibling nodes, and concatenate the calculated multiple similarities as the feature information of the child node.

[0021] The feature information of all child nodes of the parent node of each subtree in the tree structure is aggregated to generate the basic matrix of the parent node of each subtree based on the aggregated feature information.

[0022] Multiple aggregations are performed on each time slice within the predetermined time period to generate multiple input matrices based on the fundamental matrix. Data feature transformations are then applied to these multiple input matrices to determine an output matrix of a specific dimension.

[0023] The output matrix is ​​normalized to determine the cross-entropy loss between the predicted value and the label value, thereby constructing the tree neural network detection model of the network to be detected.

[0024] The time to be detected corresponds to a time slice.

[0025] Preferably, based on network traffic information within the predetermined time period, the similarity between each child node in each subtree of the tree structure and each of its one or more sibling nodes is calculated, and the calculated multiple similarities are concatenated as feature information of the child node, including:

[0026] Feature information is determined based on the following formula:

[0027]

[0028] Among them, z i This represents the traffic information vector of child node i, determined based on network traffic information within a predetermined time period. Sibling node j is the sibling node of child node i. j Let represent the traffic information vector of sibling node j determined based on network traffic information within a predetermined time period. Sim(·)(t) represents the similarity calculation function used to determine the similarity between two nodes at time t based on the traffic information vector. This indicates that child node i and sibling node j are children of parent node v. Let v be the set of child nodes of parent node v. This indicates that after calculating the similarity between child node i and each of its multiple sibling nodes, the calculated similarities are concatenated to form the feature information of child node i. Con{} represents the concatenation of the calculated similarities, and the feature information of child node i is used to represent the similarity vector of child node i.

[0029] Preferably, the feature information of all child nodes of the parent node of each subtree in the tree structure is aggregated to generate the basic matrix of the parent node of each subtree based on the aggregated feature information, including:

[0030] The base matrix of the parent node of each subtree is generated based on the following formula:

[0031]

[0032] Among them, X v(t) represents the fundamental matrix of the parent node v at the current time t. This represents the set of all child nodes of parent node v at the current time t. And representing that child node i belongs to First_children_aggregation represents the aggregation operation on the feature information or similarity vectors of all child nodes of parent node v, where child node i is a child node of parent node v. α represents the feature information or similarity vector of node i. iv The attention weights represent the degree of association between parent node v and child node i, where avg is the average value, and W is the mean value. struct Here is the weight matrix; σ is the sigmoid activation function;

[0033] Self_similar_difference represents the difference in feature information or similarity vectors of parent node v between adjacent time slices t and t-1, where X v (t)-X v (t-1) represents the difference in time similarity between time slice t and time slice t-1 after aggregation of parent node v;

[0034] Self_similar represents the aggregation of the self-similarity of parent node v at the previous time t-1 at the current time t, X v (t-1) represents the basic matrix after the parent node v aggregates the feature information of the child node in the previous time slice between adjacent time slices t and t-1;

[0035] W t and W rec All of them are weight matrices.

[0036] Preferably, multiple aggregations are performed on each time slice within the predetermined time period to generate multiple input matrices based on the base matrix. Data feature transformations are then applied to these multiple input matrices to determine an output matrix of a specific dimension, including:

[0037] For each time slice within the predetermined time period, perform l aggregation operations. Each l aggregation operation generates l input matrices based on the base matrix. Take the average of the l input matrices to determine the intermediate matrix X at the current time t. K (t), the formula is as follows:

[0038] X K (t)=avg(X v (t) (1) ,X v (t) (2) ,…,X v (t)(l) )

[0039] Among them, X v (t) (l) Let X be the fundamental matrix at time slice t. v The input matrix generated by the l-th aggregation operation of (t); X v (t) (2) The fundamental matrix X for the second time slice v The input matrix generated by the second aggregation operation of (t); avg is the average value;

[0040] The number of time slices within the predetermined time period is T, and the retained features are T specific-dimensional output matrices, as shown below:

[0041] X = [X] K (1),X K (2),X K (3),…,X K (T)]

[0042] Where X is an output matrix comprising T intermediate matrices or a specific dimension. K (1),X K (2),X K (3),…,X K (T) represents T intermediate matrices or specific dimensions, each intermediate matrix representing a feature dimension, X. K (T) represents the Tth intermediate matrix or a specific dimension; each intermediate matrix or feature dimension corresponds to a time slice within a predetermined time period;

[0043] The output matrix X has dimensions (T, C, C). The output matrix X is transformed into its transpose using data feature transformation. Used to represent the transpose matrix X T Dimensions.

[0044] Preferably, the output matrix is ​​normalized to determine the cross-entropy loss between the predicted value and the label value, thereby constructing a tree neural network detection model for the network to be detected, including:

[0045] Normalization is performed using the softmax function, and the probabilities of a network node having malicious traffic and the probabilities of it having malicious traffic are output, expressed as:

[0046]

[0047] X = [X] K (1),X K (2),X K (3),…,X K(T)]

[0048] This is a two-dimensional vector output by the tree neural network detection model. The first dimension of the two-dimensional vector represents the probability that network node i does not contain malicious traffic, and the second dimension represents the probability that network node i contains malicious traffic.

[0049] in, X is the output matrix of the tree neural network detection model, where the number of network nodes in the network to be detected is C, and X is the output matrix including T intermediate matrices or a specific dimension. K (1),X K (2),X K (3),…,X K (T) represents T intermediate matrices or a specific dimension, X T Let X be the transpose of X, where W (i) This is the weight matrix. Used to represent W (i) Dimensions b (i) The bias matrix, Used to represent b (i) Dimensions.

[0050] Preferably, the method further includes using a cross-entropy loss function as the loss function to ensure convergence until the training process reaches a stable state, as shown in the following formula:

[0051]

[0052] Where Loss is the loss function, y i Let i be the label value of network node i, and C be the number of network nodes, where 1 ≤ i ≤ C. It is a two-dimensional vector output by the tree neural network detection model.

[0053] Preferably, the network nodes that detect malicious traffic among multiple network nodes in the network to be detected include:

[0054] When network node i When the probability that network node i, indicated by the first dimension, does not have malicious traffic is greater than the first probability threshold, network node i is determined to be a network node without malicious traffic.

[0055] Preferably, the network nodes that detect malicious traffic among multiple network nodes in the network to be detected include:

[0056] When network node i When the probability of network node i having malicious traffic, as indicated by the second dimension, is greater than the second probability threshold, network node i is determined to be a network node with malicious traffic.

[0057] According to another aspect of the present invention, a detection device for anomalies in tree neural network nodes is provided, comprising:

[0058] The acquisition module is used to acquire network traffic information of the network to be detected within a predetermined time period;

[0059] The first construction module is used to construct a tree structure of the network to be detected based on multiple network nodes of the network to be detected;

[0060] The second construction module is used to construct a tree neural network detection model of the network to be detected based on network traffic information within a predetermined time period and the tree structure; and

[0061] The detection module is used to acquire network traffic information of the network to be detected at the time of detection, input it into the tree neural network detection model, and detect network nodes with malicious traffic among multiple network nodes of the network to be detected.

[0062] According to another aspect of the present invention, a computer-readable storage medium is provided, the storage medium storing a computer program for performing the methods described in any of the above aspects of the present invention.

[0063] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: a processor; a memory for storing executable instructions of the processor; the processor being configured to read the executable instructions from the memory and execute the instructions to implement the method described in any of the preceding aspects of the present invention.

[0064] Therefore, this application provides a method for detecting network nodes based on tree neural networks. It assumes that the representation learning of dynamic graphics is a process of interaction between nodes, updating relevant node representations through events. It assumes that attacked nodes share similarities, so the node vector is calculated from the similarity between the node itself and nodes of the same order. This achieves the modeling process of a tree-like dynamic network, thereby realizing the technical effect of determining whether a network node has been attacked by malicious traffic. This application proposes that using a novel tree-like neural network to detect malicious traffic can effectively improve the accuracy and efficiency of malicious traffic detection. It can automatically extract features from raw data without manual intervention, avoiding the difficulty of feature selection; and it can detect the normality or abnormality of nodes in a constantly changing dynamic network by updating nodes. Attached Figure Description

[0065] Exemplary embodiments of the present invention can be more fully understood by referring to the following figures:

[0066] Figure 1This is a flowchart illustrating an exemplary embodiment of the method for detecting anomalies in tree neural network nodes provided by the present invention.

[0067] Figure 2 This is a schematic diagram of an exemplary embodiment of the present invention, illustrating the abstraction of a network into multiple tree structures with only two layers.

[0068] Figure 3 This is a schematic diagram of a data storage method provided by an exemplary embodiment of the present invention;

[0069] Figure 4 This is a schematic diagram of the parent-child hierarchical structure storage of a network provided in an exemplary embodiment of the present invention;

[0070] Figure 5 This is a schematic diagram of the structure of a detection device for abnormal nodes in a tree neural network provided in an exemplary embodiment of the present invention;

[0071] Figure 6 This is the structure of an electronic device provided in an exemplary embodiment of the present invention. Detailed Implementation

[0072] Hereinafter, exemplary embodiments according to the present invention will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments of the present invention. It should be understood that the present invention is not limited to the exemplary embodiments described herein.

[0073] It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0074] Those skilled in the art will understand that the terms "first," "second," etc., in the embodiments of the present invention are only used to distinguish different steps, devices, or modules, and do not represent any specific technical meaning, nor do they indicate a necessary logical order between them.

[0075] It should also be understood that in the embodiments of the present invention, "multiple" can refer to two or more, and "at least one" can refer to one, two or more.

[0076] It should also be understood that any component, data or structure mentioned in the embodiments of the present invention can generally be understood as one or more unless explicitly defined or given contrary instructions in the context.

[0077] Furthermore, the term "and / or" in this invention is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this invention generally indicates that the preceding and following related objects have an "or" relationship.

[0078] It should also be understood that the description of the various embodiments in this invention emphasizes the differences between the various embodiments, and the similarities or similarities can be referred to each other. For the sake of brevity, they will not be described in detail.

[0079] At the same time, it should be understood that, for ease of description, the dimensions of the various parts shown in the accompanying drawings are not drawn according to actual scale.

[0080] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the invention, its application, or uses.

[0081] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, they should be considered part of the specification.

[0082] It should be noted that similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be discussed further in subsequent figures.

[0083] The embodiments of this invention can be applied to electronic devices such as terminal devices, computer systems, and servers, and can operate together with a wide range of other general-purpose or special-purpose computing system environments or configurations. Well-known examples of terminal devices, computing systems, environments, and / or configurations suitable for use with electronic devices such as terminal devices, computer systems, and servers include, but are not limited to: personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments including any of the above systems, etc.

[0084] Electronic devices such as terminal devices, computer systems, and servers can be described in the general context of computer system executable instructions (such as program modules) executed by a computer system. Typically, program modules can include routines, programs, object programs, components, logic, data structures, etc., which perform specific tasks or implement specific abstract data types. Computer systems / servers can be implemented in distributed cloud computing environments, where tasks are executed by remote processing devices linked through communication networks. In distributed cloud computing environments, program modules can reside on local or remote computing system storage media, including storage devices.

[0085] Exemplary methods

[0086] Figure 1 This is a schematic flowchart of an anomaly detection method for tree neural network nodes provided in an exemplary embodiment of the present invention. This embodiment can be applied to electronic devices, such as… Figure 1 As shown, the method 100 for detecting anomalies in tree neural network nodes includes the following steps:

[0087] Step 101: Obtain network traffic information of the network to be tested within a predetermined time period.

[0088] Optionally, network traffic information includes: inbound and outbound traffic of nodes, protocol distribution, port distribution, IP address distribution, and bandwidth utilization.

[0089] Specifically, network packet capture programs obtain network traffic information. Network traffic information refers to the amount of data transmitted within a network and related statistics. It can include the following:

[0090] Inbound and outbound traffic: The amount of data traffic entering and leaving a specific node (such as a router or interface) in the network.

[0091] Protocol distribution: The proportion of traffic from different protocols, such as HTTP, FTP, SMTP, etc. This helps in understanding different types of data flow in the network.

[0092] Port distribution: The proportion of data transmitted using different network ports. Each application typically uses a specific port for communication.

[0093] IP address distribution: The proportion of different IP addresses sending and receiving data on a network. This helps identify the most active hosts or sources on the network.

[0094] Bandwidth utilization: The ratio between the actual bandwidth used on a network link and the available bandwidth. It reflects the network's activity level.

[0095] Step 102: Construct a tree structure of the network to be detected based on the multiple network nodes of the network to be detected.

[0096] Optionally, a tree structure of the network to be detected is constructed based on the network nodes of the network to be detected, including:

[0097] Network nodes are abstracted into a tree structure with only two levels, which includes the root node and leaf nodes. The root node is a router or data aggregation device in a small network, and the leaf nodes are all the network hosts under that device.

[0098] According to another embodiment, the multiple network nodes of the network to be detected are abstracted into a tree structure including M layers, wherein the tree structure includes: a root node, intermediate nodes and leaf nodes, the root node is a router or data aggregation device, the intermediate nodes and leaf nodes are network nodes connected to the router or data aggregation device, and M is greater than or equal to 2; wherein the layer where the root node is located is the first layer.

[0099] Alternatively, the tree adjacency matrix of the tree structure can be represented as:

[0100]

[0101] Wherein, at the current moment, network node i and network node j are communicating, and network node i points to network node j, then network node i is the parent node of network node j, A ij =1, otherwise A i,j =0.

[0102] According to another embodiment, if network node i and network node j are communicating via data at current time t, and data is sent from network node i to network node j, the data flow at current time t is from network node i to network node j, and the direction of the data flow at current time t is represented as follows: point to Then network node i is the parent node of network node j, A ij =1, Represents the network node i at the current moment. Represents network node j at the current time t;

[0103] If network node i and network node j do not have data communication at the current time t, then A i,j =0 represents the network node at the current time, and represents the network node at the current time t;

[0104] Here, the current time t corresponds to a time slice. The current time t corresponds to the t-th time slice, and the previous time t-1 corresponds to the (t-1)-th time slice.

[0105] Specifically, since the propagation of malicious traffic in a network can be viewed as a tree, the parent-child relationships in the tree structure reflect the propagation behavior. A parent node can connect to multiple child nodes, and a child node can be a leaf node or a parent node at the next lower level.

[0106] Specifically, since the propagation of malicious traffic in a network can be viewed as a tree, the parent-child relationships in the tree structure reflect the propagation behavior. A parent node can connect to multiple child nodes, and a child node can be a leaf node or a parent node at the next lower level.

[0107] Therefore, the following tree network structure is defined: (e.g.) Figure 2 The network is abstracted into multiple two-level tree structures, including a root node and leaf nodes. The root node is a router or data aggregation device in a small network, and the leaf nodes are all network hosts under that device. These hosts have directed connections with other nodes; nodes that do not communicate with each other are considered unrelated. Figure 2 The storage method for data in a tree structure can be similar to the child representation method of a tree network, such as... Figure 3 The first column is the parent node's ID, and the second column stores the similarity of that node's child nodes. The parent-child hierarchical structure of the network also borrows from a tree structure for storage; if the root node points to a child node, the value is 1, otherwise it's 0. Figure 4 Due to the dynamic nature of networks, the number of child nodes is not fixed, causing the feature dimensions of parent nodes to change, which is detrimental to computation. Therefore, defining the maximum number of child nodes for a parent node is equivalent to defining the feature dimension of the root node, denoted here as N. Since the number of protected parent nodes is also not necessarily fixed, the size of the parent node matrix is ​​also defined, denoted by C for ease of subsequent calculations, thus forming a C*N data matrix.

[0108] This application defines a tree as (a ij ) m×n In this model, j represents the child node of i, m is the number of nodes, and n is the maximum number of children that each node can propagate to. Due to the dynamic nature of the network, the number of parent and child nodes is not fixed. For ease of calculation, the number of parent nodes and the maximum number of child nodes are defined as m and n, respectively, thus forming an m×n data matrix. If only malicious traffic propagation behavior on the local area network is detected, the model simplifies to multiple two-level tree structures, including the root node and leaf nodes. The root node is the protected node, and the leaf nodes are the network hosts that communicate with it. They have directed edges connecting to the root node. Nodes that do not communicate are considered unrelated, and this topological relationship is represented by an adjacency matrix.

[0109] This application represents the dynamic evolution of a tree in a discrete manner using time slices, and uses a set of ordered trees to represent the dynamic tree. TR = (TR 1 TR 2 ....TR T ), where t = 1, 2, ..., T represents the number of snapshots of the tree formed over the time series. Therefore, according to the definition, a tree-structured adjacency matrix can be constructed for each tree snapshot as shown below, which reveals the child nodes corresponding to each node and their number:

[0110]

[0111] The formula above represents the communication connection between parent and child nodes. If node i and node j are communicating at the current moment, and node i points to node j, then node i is considered the parent node of node j. Therefore, A... ij =1, otherwise A i,j =0. This adjacency matrix will be used in subsequent detection.

[0112] Step 103: Based on the network traffic information within a predetermined time period and the tree structure, construct a tree neural network detection model for the network to be detected.

[0113] Optionally, based on network traffic information and tree structure within a predetermined time period, a tree neural network detection model for the network to be detected is constructed, including:

[0114] Calculate the similarity between each child node and its sibling nodes in the tree structure based on network traffic information, and then concatenate the calculated similarity as the feature information of that child node.

[0115] In an aggregated tree structure, the child node information of each tree is updated to update the parent node of that tree;

[0116] Multiple aggregations are performed on each time slice within a predetermined time period to generate multiple input vectors. Data feature transformations are then applied to these multiple output vectors to output a specific dimension output vector.

[0117] The output vector is normalized to determine the cross-entropy loss between the predicted and labeled values, thus optimizing the tree neural network detection model.

[0118] Optionally, the similarity between each child node and its sibling nodes in the tree structure is calculated based on network traffic information, and the calculated similarity is concatenated as the feature information of that child node using the following formula:

[0119]

[0120] In the formula, z represents the node traffic information vector. Sim(·)(t) represents the similarity calculation function between two nodes at time t, where i and j are child nodes of node v. This means that after calculating the similarity between child node i and its sibling nodes, the results are concatenated together to form the feature information of node i.

[0121] Optionally, the formula for updating the parent node of each tree in the aggregated tree structure using the child node information is as follows:

[0122]

[0123] In the formula, X v (t) represents the vector representation of the parent node after the current time step. Let represent the set of nodes adjacent to node i at time t, where i belongs to the set of child nodes in the time slice. First_children_aggregation represents the aggregation operation on the similarity vectors of the child nodes of parent node v, where i is a child node of node v. Represents the node similarity vector, α iv X represents the attention weight, i.e., the importance of the parent node to its child nodes. Self_similar_difference represents the difference in similarity vectors between two consecutive time slices, where X... v (t)-X v (t-1) represents the difference in temporal similarity between two time slices after aggregation of the parent node itself, and Self_similar represents the calculation of the self-similarity at the previous time step after aggregation. X v (t-1) represents the vector representation of the similarity of the parent node to its child nodes in the previous time slice;

[0124] in, The calculation formula for the process is as follows:

[0125] X v (t)=σ(A T X v (t-1) T W+b)

[0126] In the formula, X v (t-1) T Let A be the transpose of the matrix updated at time t-1. T Let W be the transpose of the tree adjacency matrix, where W is the parameter matrix and b is the bias matrix.

[0127] Optionally, multiple aggregations are performed on each time slice within a predetermined time period to generate multiple input vectors. Data feature transformations are then applied to these multiple output vectors to output a specific dimension output vector, including:

[0128] For each time slice, perform l aggregations. Multiple aggregation operations will generate l output vectors. Take the average, as shown in the following formula:

[0129] X v (t)=avg(X v (t) (1) ,X v (t) (2) ,…,X v (t) (l) )

[0130] There are a total of T time slices, and the retained features have a total of T output vectors, represented as follows:

[0131] X = [X1, X2, ..., X T ]

[0132] The input data X received by the output layer has dimensions (T, C, C), and after data feature transformation, it becomes...

[0133] Optionally, the output vector is normalized to determine the cross-entropy loss between the predicted and labeled values, thus optimizing the tree neural network detection model, including:

[0134] The probability of whether a node is normal is output by normalizing using the softmax function, expressed as:

[0135]

[0136] X = [X1, X2, ..., X T ]

[0137] The model outputs a two-dimensional vector, where the first and second dimensions represent the probabilities of a network node being normal or abnormal, respectively. This indicates that there are C nodes to be detected, and X is the input data. T Let X be the transpose of X, where This is the weight matrix. This is the bias matrix;

[0138] The loss function used is the cross-entropy loss function, which converges until it reaches a plateau during training. The formula is as follows:

[0139]

[0140] Among them, y i For label values, is the predicted value, which is calculated using the softmax function.

[0141] Specifically, firstly, using the traffic information obtained in step one (inbound and outbound traffic, protocol distribution, port distribution, IP address distribution, and bandwidth utilization), the similarity between each network device node's child nodes and its other sibling nodes is calculated, as shown in the following formula:

[0142]

[0143] Where z represents the node traffic information vector. Sim(·)(t) represents the similarity calculation function between two nodes at time t, and i and j are child nodes of node v. This means that after calculating the similarity between child node i and its other sibling nodes, the similarities are concatenated together to form the feature information of that node.

[0144] Then, the tree neural network relationships modeled in step two are used to aggregate child information to update the parent node representation. To capture the correlation between children and parent nodes in adjacent time slices, computation is needed using both consecutive time slices:

[0145]

[0146] Among them, X v (t) represents the vector representation of the parent node after the current time. `i` belongs to the set of child nodes in the time slice. `First_children_aggregation` represents the aggregation operation on the similarity vectors of the child nodes of parent node `v`. Here, `i` represents the child nodes of node `v`. Represents the node similarity vector, α iv This represents the attention weight, i.e., the importance of the parent node compared to its child nodes. `Self_similar_difference` represents the difference in the similarity vectors of the parent node between two consecutive time slices, where X... v (t)-X v (t-1) represents the difference in temporal similarity between two time slices after aggregation of the parent node. Self_similar represents the calculation of the self-similarity at the previous time step after aggregation, X v (t-1) represents the vector representation of the similarity of the parent node to its child nodes in the previous time slice.

[0147] in, The calculation formula for the process is shown below:

[0148] X v (t)=σ(A T X v (t-1) T W+b)

[0149] X v(t-1) T Let A be the transpose of the matrix updated at time t-1. T This represents the transpose of the tree-like adjacency matrix. W is the parameter matrix, and b is the bias matrix; both are learnable matrices.

[0150] For each time slice, we perform l aggregations. Multiple aggregation operations will generate l output vectors. Here, we take the average operation, and the formula is as follows.

[0151] X v (t)=avg(X v (t) (1) ,X v (t) (2) ,…,X v (t) (l) )

[0152] Since there are T time slices in total, there are a total of T output vectors for the retained features. This is represented as follows:

[0153] X = [X1, X2, ..., X T ]

[0154] Finally, the input data X received by the output layer has dimensions (T, C, C), and after data feature transformation, it becomes... This is the weight matrix. The bias matrix and the output layer are obtained through training. The output layer is connected to a fully connected layer, and the probability of whether a node is normal is normalized by the softmax function.

[0155]

[0156] The model outputs a predicted value to determine whether a target host node is under attack by malicious traffic. Therefore, the problem is a binary classification problem, and the model outputs a two-dimensional vector. The first and second dimensions represent the probability of the node being normal or abnormal, respectively. This indicates that there are C nodes to be detected.

[0157] The cross-entropy loss function is used, which converges until it reaches a plateau during training. The formula is as follows:

[0158]

[0159] Among them, y i For label values, This is the predicted value, which is calculated using the softmax method mentioned above.

[0160] According to another embodiment, a tree neural network detection model for the network to be detected is constructed based on network traffic information within a predetermined time period and the tree structure, including:

[0161] Starting from the root node of the tree structure, proceeding towards the leaf nodes of the Mth layer, acquire two layers at a time with a step size of one layer, and perform calculations until the Mth layer of the tree structure is involved in the calculation. Execute:

[0162] Based on the network traffic information within the predetermined time period, calculate the similarity between each child node in each subtree of the tree structure and each of its one or more sibling nodes, and concatenate the calculated multiple similarities as the feature information of the child node;

[0163] The feature information of all child nodes of the parent node of each subtree in the tree structure is aggregated to generate the basic matrix of the parent node of each subtree based on the aggregated feature information.

[0164] Multiple aggregations are performed on each time slice within the predetermined time period to generate multiple input matrices based on the fundamental matrix. Data feature transformations are then applied to these multiple input matrices to determine an output matrix of a specific dimension.

[0165] The output matrix is ​​normalized to determine the cross-entropy loss between the predicted value and the label value, thereby constructing the tree neural network detection model of the network to be detected.

[0166] The time to be detected corresponds to a time slice.

[0167] The process begins at the level containing the root node of the tree structure and proceeds towards the leaf nodes of the Mth level, acquiring two levels at a time with a step size of one level, and performing calculations until the Mth level of the tree structure is involved in the calculation. Specifically, when the tree structure has 6 levels (M is 6), the level containing the root node is the 1st level, and the level adjacent to the root node is the 2nd level. The first time, the 1st level (including the root node) and the adjacent 2nd level are acquired and calculated; the second time, the 2nd and 3rd levels are acquired and calculated; the third time, the 3rd and 4th levels are acquired and calculated; the fourth time, the 4th and 5th levels are acquired and calculated; the fifth time, the 5th and 6th levels are acquired and calculated. Since the 6th level (the Mth level) is involved in the calculation, the calculation ends after the 5th acquisition and calculation of the 5th and 6th levels.

[0168] According to another embodiment, based on network traffic information within the predetermined time period, the similarity between each child node in each subtree of the tree structure and each of its one or more sibling nodes is calculated, and the calculated multiple similarities are concatenated as feature information of the child node, including:

[0169] Feature information is determined based on the following formula:

[0170]

[0171] Among them, z i This represents the traffic information vector of child node i, determined based on network traffic information within a predetermined time period. Sibling node j is the sibling node of child node i. j Let represent the traffic information vector of sibling node j determined based on network traffic information within a predetermined time period. Sim(·)(t) represents the similarity calculation function used to determine the similarity between two nodes at time t based on the traffic information vector. This indicates that child node i and sibling node j are children of parent node v. Let v be the set of child nodes of parent node v. This indicates that after calculating the similarity between child node i and each of its multiple sibling nodes, the calculated similarities are concatenated to form the feature information of child node i. Con{} represents the concatenation of the calculated similarities, and the feature information of child node i is used to represent the similarity vector of child node i.

[0172] According to another embodiment, the feature information of all child nodes of the parent node of each subtree in the tree structure is aggregated to generate a basic matrix of the parent node of each subtree based on the aggregated feature information, including:

[0173] The base matrix of the parent node of each subtree is generated based on the following formula:

[0174]

[0175] Among them, X v (t) represents the fundamental matrix of the parent node v at the current time t. This represents the set of all child nodes of parent node v at the current time t. And representing that child node i belongs to First_children_aggregation represents the aggregation operation on the feature information or similarity vectors of all child nodes of parent node v, where child node i is a child node of parent node v. α represents the feature information or similarity vector of node i. ivThe attention weights represent the degree of association between parent node v and child node i, where avg is the average value, and W is the mean value. struct Here is the weight matrix; σ is the sigmoid activation function;

[0176] Self_similar_difference represents the difference in feature information or similarity vectors of parent node v between adjacent time slices t and t-1, where X v (t)-X v (t-1) represents the difference in time similarity between time slice t and time slice t-1 after aggregation of parent node v;

[0177] Self_similar represents the aggregation of the self-similarity of parent node v at the previous time t-1 at the current time t, X v (t-1) represents the basic matrix after the parent node v aggregates the feature information of the child node in the previous time slice between adjacent time slices t and t-1;

[0178] W t and W rec All of them are weight matrices.

[0179] According to another embodiment, multiple aggregations are performed on each time slice within the predetermined time period to generate multiple input matrices based on a fundamental matrix. Data feature transformations are then applied to these multiple input matrices to determine an output matrix of a specific dimension, including:

[0180] For each time slice within the predetermined time period, perform l aggregation operations. Each l aggregation operation generates l input matrices based on the base matrix. Take the average of the l input matrices to determine the intermediate matrix X at the current time t. K (t), the formula is as follows:

[0181] X K (t)=avg(X v (t) (1) ,X v (t) (2) ,…,X v (t) (l) )

[0182] Among them, X v (t) (l) Let X be the fundamental matrix at time slice t. v The input matrix generated by the l-th aggregation operation of (t); X v (t) (2) The fundamental matrix X for the second time slice v The input matrix generated by the second aggregation operation of (t); avg is the average value;

[0183] The number of time slices within the predetermined time period is T, and the retained features are T specific-dimensional output matrices, as shown below:

[0184] X = [X] K (1),X K (2),X K (3),…,X K (T)]

[0185] Where X is an output matrix comprising T intermediate matrices or a specific dimension. K (1),X K (2),X K (3),…,X K (T) represents T intermediate matrices or specific dimensions, each intermediate matrix representing a feature dimension, X. K (T) represents the Tth intermediate matrix or a specific dimension; each intermediate matrix or feature dimension corresponds to a time slice within a predetermined time period.

[0186] The output matrix X has dimensions (T, C, C). The output matrix X is transformed into its transpose using data feature transformation. Used to represent the transpose matrix X T Dimensions.

[0187] According to another embodiment, the output matrix is ​​normalized to determine the cross-entropy loss between the predicted value and the label value, thereby constructing a tree neural network detection model for the network to be detected, including:

[0188] Normalization is performed using the softmax function, and the probabilities of a network node having malicious traffic and the probabilities of it having malicious traffic are output, expressed as:

[0189]

[0190] X = [X] K (1),X K (2),X K (3),…,X K (T)]

[0191] This is a two-dimensional vector output by the tree neural network detection model. The first dimension of the two-dimensional vector represents the probability that network node i does not contain malicious traffic, and the second dimension represents the probability that network node i contains malicious traffic.

[0192] in, X is the output matrix of the tree neural network detection model, where the number of network nodes in the network to be detected is C, and X is the output matrix including T intermediate matrices or a specific dimension. K (1),X K (2),X K (3),…,X K (T) represents T intermediate matrices or a specific dimension, X T Let X be the transpose of X, where W (i) This is the weight matrix. Used to represent W (i) Dimensions b (i) The bias matrix, Used to represent b (i) Dimensions.

[0193] According to another embodiment, the method further includes using a cross-entropy loss function as the loss function to achieve convergence until the training process reaches a plateau, as shown in the following formula:

[0194]

[0195] Where Loss is the loss function, y i Let i be the label value of network node i, and C be the number of network nodes, where 1 ≤ i ≤ C. It is a two-dimensional vector output by the tree neural network detection model.

[0196] Step 104: Obtain network traffic information of the network to be detected at the time of detection, input it into the tree neural network detection model, and detect abnormal nodes in the network to be detected that have malicious traffic.

[0197] Specifically, network traffic information of the network under test at the time of test is collected, including the incoming and outgoing traffic of nodes, protocol distribution, port distribution, IP address distribution, and bandwidth utilization. This information is then input into a tree neural network model, and the output for each network node is either normal or abnormal.

[0198] According to another embodiment, network traffic information of the network to be detected at the time of detection is obtained and input into the tree neural network detection model to detect network nodes with malicious traffic among multiple network nodes of the network to be detected, including:

[0199] Obtain the network traffic information of the network to be detected at the time of detection, and input it into the tree neural network detection model. When network node i... When the probability that network node i, indicated by the first dimension, does not have malicious traffic is greater than the first probability threshold, network node i is determined to be a network node without malicious traffic.

[0200] According to another embodiment, network traffic information of the network to be detected at the time of detection is obtained and input into the tree neural network detection model to detect network nodes with malicious traffic among multiple network nodes of the network to be detected, including:

[0201] Obtain the network traffic information of the network to be detected at the time of detection, and input it into the tree neural network detection model. When network node i... When the probability of network node i having malicious traffic, as indicated by the second dimension, is greater than the second probability threshold, network node i is determined to be a network node with malicious traffic.

[0202] Therefore, this application provides a method for detecting anomalies in tree neural network nodes, generating a novel tree-based dynamic network framework. This framework assumes that the representation learning of dynamic graphics is a process of interaction between nodes, updating relevant node representations through events. It assumes that attacked nodes share similarities, so node vectors are calculated based on the similarity between the node itself and nodes of the same order, thus realizing the modeling process of the tree-based dynamic network and achieving the technical effect of determining whether network nodes have been attacked by malicious traffic. This application proposes that using a novel tree-based neural network to detect malicious traffic can effectively improve the accuracy and efficiency of malicious traffic detection. It can automatically extract features from raw data without manual intervention, avoiding the problem of difficult feature selection; and it can detect the normality or abnormality of nodes in a constantly changing dynamic network by updating nodes.

[0203] Cluster analysis is used to determine whether a host node is under attack or in a normal state. It shows the normal communication and attack / infection behaviors that occur between hosts over time, corresponding to the increase or decrease in the number of network host nodes and the addition or deletion of communication edges between two host nodes.

[0204] Exemplary device

[0205] Figure 5 This is a schematic diagram of the structure of a tree neural network node anomaly detection device provided in an exemplary embodiment of the present invention. Figure 5 As shown, the device 500 includes:

[0206] The acquisition module 510 is used to acquire network traffic information of the network to be detected within a predetermined time period;

[0207] The first construction module 520 is used to construct a tree structure of the network to be detected based on the network nodes of the network to be detected;

[0208] The second construction module 530 is used to construct a tree neural network detection model of the network to be detected based on network traffic information and tree structure within a predetermined time period.

[0209] The detection module 540 is used to acquire network traffic information of the network under test at the time of test, input it into the tree neural network detection model, and detect abnormal nodes in the network under test that contain malicious traffic.

[0210] Optionally, network traffic information includes: inbound and outbound traffic of nodes, protocol distribution, port distribution, IP address distribution, and bandwidth utilization.

[0211] Optionally, the first building module 520 includes:

[0212] This is abstracted into submodules to abstract network nodes into a tree structure with only two levels. The tree structure includes the root node and leaf nodes. The root node is a router or data aggregation device in a small network, and the leaf nodes are all network hosts under that device.

[0213] Alternatively, the tree adjacency matrix of the tree structure can be represented as:

[0214]

[0215] Wherein, at the current moment, network node i and network node j are communicating, and network node i points to network node j, then network node i is the parent node of network node j, A ij =1, otherwise A i,j =0.

[0216] Optionally, the first building module 520 includes:

[0217] The first calculation submodule is used to calculate the similarity between each child node and other sibling nodes in the tree structure based on network traffic information, and to concatenate the calculated similarity as the feature information of the child node.

[0218] The update submodule is used to aggregate the child node information of each tree in the tree structure and update the parent node of that tree;

[0219] The aggregation submodule is used to perform multiple aggregations on each time slice within a predetermined time period, generate multiple input vectors, perform data feature transformations on the multiple output vectors, and output a specific dimension output vector.

[0220] The optimization submodule is used to normalize the output vector, determine the cross-entropy loss between the predicted value and the label value, and optimize the tree neural network detection model.

[0221] Optionally, the similarity between each child node and its sibling nodes in the tree structure is calculated based on network traffic information, and the calculated similarity is concatenated as the feature information of that child node using the following formula:

[0222]

[0223] In the formula, z represents the node traffic information vector. Sim(·)(t) represents the similarity calculation function between two nodes at time t, where i and j are child nodes of node v. This means that after calculating the similarity between child node i and its sibling nodes, the results are concatenated together to form the feature information of node i.

[0224] Optionally, the formula for updating the parent node of each tree in the aggregated tree structure using the child node information is as follows:

[0225]

[0226] In the formula, X v (t) represents the vector representation of the parent node after the current time step. Let represent the set of nodes adjacent to node i at time t, where i belongs to the set of child nodes in the time slice. First_children_aggregation represents the aggregation operation on the similarity vectors of the child nodes of parent node v, where i is a child node of node v. Represents the node similarity vector, α iv X represents the attention weight, i.e., the importance of the parent node to its child nodes. Self_similar_difference represents the difference in similarity vectors between two consecutive time slices, where X... v (t)-X v (t-1) represents the difference in temporal similarity between two time slices after aggregation of the parent node itself, and Self_similar represents the calculation of the self-similarity at the previous time step after aggregation. X v (t-1) represents the vector representation of the similarity of the parent node to its child nodes in the previous time slice;

[0227] in, The calculation formula for the process is as follows:

[0228] X v (t)=σ(A T X v (t-1) T W+b)

[0229] In the formula, X v (t-1) T Let A be the transpose of the matrix updated at time t-1. T Let W be the transpose of the tree adjacency matrix, where W is the parameter matrix and b is the bias matrix.

[0230] Optionally, the aggregation submodule includes:

[0231] The generation unit performs l aggregations for each time slice. Multiple aggregations generate l output vectors, which are then averaged using the following formula:

[0232] X v (t)=avg(X v (t) (1) ,X v (t) (2) ,…,X v (t) (l) )

[0233] The retention unit, used for a total of T time slices, retains a total of T output vectors for the retained features, as shown below:

[0234] X = [X1, X2, ..., X T ]

[0235] The transformation unit is used to transform the input data X received by the output layer into (T, C, C) data features.

[0236] Optionally, optimize submodules, including:

[0237] The output unit, used to output the probability of whether a node is normal by normalizing it using the softmax function, is represented as:

[0238]

[0239] X = [X1, X2, ..., X T ]

[0240] The model outputs a two-dimensional vector, where the first and second dimensions represent the probabilities of a network node being normal or abnormal, respectively. This indicates that there are C nodes to be detected, and X is the input data. T Let X be the transpose of X, where This is the weight matrix. This is the bias matrix;

[0241] A unit is used, and the cross-entropy loss function is employed to ensure convergence until stationarity during training, as shown in the following formula:

[0242]

[0243] Among them, y i For label values, is the predicted value, which is calculated using the softmax function.

[0244] Exemplary electronic devices

[0245] Figure 6 This is the structure of an electronic device provided in an exemplary embodiment of the present invention. For example... Figure 6 As shown, the electronic device 60 includes one or more processors 61 and a memory 62.

[0246] The processor 61 may be a central processing unit (CPU) or other form of processing unit with data processing and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions.

[0247] The memory 62 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 61 may execute the program instructions to implement the methods of the software programs of the various embodiments of the present invention described above, and / or other desired functions. In one example, the electronic device may also include an input device 63 and an output device 64, these components being interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0248] In addition, the input device 63 may also include, for example, a keyboard, a mouse, etc.

[0249] The output device 64 can output various information to the outside. The output device 64 may include, for example, a display, a speaker, a printer, and a communication network and its connected remote output devices, etc.

[0250] Of course, for the sake of simplicity, Figure 6 Only some of the components of this electronic device relevant to the present invention are shown, omitting components such as buses, input / output interfaces, etc. In addition, the electronic device may include any other suitable components depending on the specific application.

[0251] Exemplary computer program products and computer-readable storage media

[0252] In addition to the methods and apparatus described above, embodiments of the present invention may also be computer program products, which include computer program instructions that, when executed by a processor, cause the processor to perform the steps in the methods according to various embodiments of the present invention described in the "Exemplary Methods" section above.

[0253] The computer program product can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of the present invention. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0254] Furthermore, embodiments of the present invention may also be computer-readable storage media storing computer program instructions thereon, which, when executed by a processor, cause the processor to perform the steps of the methods according to various embodiments of the present invention described in the "Exemplary Methods" section above.

[0255] The computer-readable storage medium may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.

[0256] The basic principles of the present invention have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in the present invention are merely examples and not limitations, and should not be considered as essential features of each embodiment of the present invention. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the present invention to the necessity of employing the aforementioned specific details.

[0257] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For system embodiments, since they largely correspond to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0258] The block diagrams of devices, systems, devices, and systems involved in this invention are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, systems, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0259] The methods and systems of the present invention may be implemented in many ways. For example, they may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above-described order of steps for the methods is for illustrative purposes only, and the steps of the methods of the present invention are not limited to the order specifically described above unless otherwise specifically stated. Furthermore, in some embodiments, the present invention may also be implemented as a program recorded on a recording medium, the program comprising machine-readable instructions for implementing the methods according to the present invention. Thus, the present invention also covers recording media storing programs for performing the methods according to the present invention.

[0260] It should also be noted that in the systems, apparatus, and methods of the present invention, the components or steps can be disassembled and / or recombined. These disassemblies and / or recombinations should be considered equivalents of the present invention. The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the invention. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects without departing from the scope of the invention. Therefore, the invention is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0261] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of the invention to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A method for detecting network nodes based on a tree neural network, characterized in that, include: Obtain network traffic information of the network to be tested within a predetermined time period; Based on the multiple network nodes of the network to be detected, construct a tree structure of the network to be detected; Based on network traffic information within a predetermined time period and the tree structure, a tree neural network detection model for the network to be detected is constructed; and The network traffic information of the network to be detected at the time of detection is obtained and input into the tree neural network detection model to detect network nodes with malicious traffic among multiple network nodes of the network to be detected. Specifically, based on network traffic information within a predetermined time period and the tree structure, a tree neural network detection model for the network to be detected is constructed, including: Starting from the layer where the root node of the tree structure is located, proceeding towards the leaf node of the Mth layer, with a step size of 1 layer, obtain 2 layers at a time and perform calculations until the Mth layer of the tree structure participates in the calculation. Perform the following: Based on the network traffic information within the predetermined time period, calculate the similarity between each child node in each subtree of the tree structure and each of its one or more sibling nodes, and concatenate the calculated multiple similarities as the feature information of the child node. The feature information of all child nodes of the parent node of each subtree in the tree structure is aggregated to generate the basic matrix of the parent node of each subtree based on the aggregated feature information. Multiple aggregations are performed on each time slice within the predetermined time period to generate multiple input matrices based on the fundamental matrix. Data feature transformations are then applied to these multiple input matrices to determine an output matrix of a specific dimension. The output matrix is ​​normalized to determine the cross-entropy loss between the predicted value and the label value, thereby constructing the tree neural network detection model of the network to be detected. The time to be detected corresponds to a time slice.

2. The method according to claim 1, characterized in that, The network traffic information includes: inbound traffic of network nodes, outbound traffic of network nodes, protocol distribution, port distribution, IP address distribution, and bandwidth utilization.

3. The method according to claim 1, characterized in that, Based on multiple network nodes of the network to be detected, a tree structure of the network to be detected is constructed, including: The multiple network nodes of the network to be detected are abstracted into a tree structure with M layers, wherein the tree structure includes: the root node, intermediate nodes and leaf nodes of the tree, the root node is a router or data aggregation device, the intermediate nodes and leaf nodes are network nodes connected to the router or data aggregation device, and M is greater than or equal to 2. The root node is located in layer 1.

4. The method according to claim 3, characterized in that, The tree adjacency matrix of the tree structure is represented as: Where, if network node i and network node j are communicating at the current time t, and data is sent from network node i to network node j, the direction of the data flow at the current time t is represented as follows: point to Then network node i is the parent node of network node j, A ij =1, Represents the network node i at the current moment. Represents network node j at the current time t; If network node i and network node j do not have data communication at the current time t, then A i,j =0 represents the network node at the current time, and represents the network node at the current time t; Here, the current time t corresponds to a time slice.

5. The method according to claim 4, characterized in that, Based on network traffic information within the predetermined time period, the similarity between each child node in each subtree of the tree structure and each of its one or more sibling nodes is calculated, and the calculated similarities are concatenated as feature information of the child node, including: Feature information is determined based on the following formula: Among them, z i This represents the traffic information vector of child node i, determined based on network traffic information within a predetermined time period. Sibling node j is the sibling node of child node i. j Let represent the traffic information vector of sibling node j determined based on network traffic information within a predetermined time period. Sim(·)(t) represents the similarity calculation function used to determine the similarity between two nodes at time t based on the traffic information vector. This indicates that child node i and sibling node j are children of parent node v. Let v be the set of child nodes of parent node v. This indicates that after calculating the similarity between child node i and each of its multiple sibling nodes, the calculated similarities are concatenated to form the feature information of child node i. Con{} represents the concatenation of the calculated similarities, and the feature information of child node i is used to represent the similarity vector of child node i.

6. The method according to claim 1, characterized in that, Aggregate the feature information of all child nodes of the parent node of each subtree in the tree structure to generate the basic matrix of the parent node of each subtree based on the aggregated feature information, including: The base matrix of the parent node of each subtree is generated based on the following formula: Among them, X v (t) represents the fundamental matrix of the parent node v at the current time t. This represents the set of all child nodes of parent node v at the current time t. And representing that child node i belongs to First_children_aggregation represents the aggregation operation on the feature information or similarity vectors of all child nodes of parent node v, where child node i is a child node of parent node v. α represents the feature information or similarity vector of node i. iv The attention weights represent the degree of association between parent node v and child node i, where avg is the average value, and W is the mean value. struct Here is the weight matrix; σ is the sigmoid activation function; Self_similar_difference represents the difference in feature information or similarity vectors of parent node v between adjacent time slices t and t-1, where X v (t)-X v (t-1) represents the difference in time similarity between time slice t and time slice t-1 after aggregation of parent node v; Self_similar represents the aggregation of the self-similarity of parent node v at the previous time t-1 at the current time t, X v (t-1) represents the basic matrix after the parent node v aggregates the feature information of the child node in the previous time slice between adjacent time slices t and t-1; W t and W rec All of them are weight matrices.

7. The method according to claim 1, characterized in that, Multiple aggregations are performed on each time slice within the predetermined time period to generate multiple input matrices based on the base matrix. Data feature transformations are then applied to these multiple input matrices to determine an output matrix of a specific dimension, including: For each time slice within the predetermined time period, perform l aggregation operations. Each l aggregation operation generates l input matrices based on the base matrix. Take the average of the l input matrices to determine the intermediate matrix X at the current time t. K (t), the formula is as follows: X K (t)=avg(X v (t) (1) ,X v (t) (2) ,…,X v (t) (l) ) Among them, X v (t) (l) Let X be the fundamental matrix at time slice t. v The input matrix generated by the l-th aggregation operation of (t); X v (t) (2) The fundamental matrix X for the second time slice v The input matrix generated by the second aggregation operation of (t); avg is the average value; The number of time slices within the predetermined time period is T, and the retained features are T specific-dimensional output matrices, as shown below: X=[X K (1),X K (2),X K (3),…,X K (T)] Where X is an output matrix comprising T intermediate matrices or a specific dimension. K (1),X K (2),X K (3),…,X K (T) represents T intermediate matrices or specific dimensions, each intermediate matrix representing a feature dimension, X. K (T) represents the Tth intermediate matrix or a specific dimension; where each intermediate matrix or feature dimension corresponds to a time slice within a predetermined time period; The output matrix X has dimensions (T, C, C). The output matrix X is transformed into its transpose using data feature transformation. Used to represent the transpose matrix X T Dimensions.

8. A device for detecting network nodes based on a tree neural network, characterized in that, include: The acquisition module is used to acquire network traffic information of the network to be detected within a predetermined time period; The first construction module is used to construct a tree structure of the network to be detected based on multiple network nodes of the network to be detected; The second construction module is used to construct a tree neural network detection model of the network to be detected based on network traffic information within a predetermined time period and the tree structure. as well as The detection module is used to acquire network traffic information of the network to be detected at the time of detection, input it into the tree neural network detection model, and detect network nodes with malicious traffic among multiple network nodes of the network to be detected. Specifically, based on network traffic information within a predetermined time period and the tree structure, a tree neural network detection model for the network to be detected is constructed, including: Starting from the layer where the root node of the tree structure is located, proceeding towards the leaf node of the Mth layer, with a step size of 1 layer, obtain 2 layers at a time and perform calculations until the Mth layer of the tree structure participates in the calculation. Perform the following: Based on the network traffic information within the predetermined time period, calculate the similarity between each child node in each subtree of the tree structure and each of its one or more sibling nodes, and concatenate the calculated multiple similarities as the feature information of the child node. The feature information of all child nodes of the parent node of each subtree in the tree structure is aggregated to generate the basic matrix of the parent node of each subtree based on the aggregated feature information. Multiple aggregations are performed on each time slice within the predetermined time period to generate multiple input matrices based on the fundamental matrix. Data feature transformations are then applied to these multiple input matrices to determine an output matrix of a specific dimension. The output matrix is ​​normalized to determine the cross-entropy loss between the predicted value and the label value, thereby constructing the tree neural network detection model of the network to be detected. The time to be detected corresponds to a time slice.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program for performing the method described in any one of claims 1-7.

Images