Network intrusion detection method based on combination of graph attention mechanism and GCN

Abstract

The invention discloses a network intrusion detection method based on combination of a graph attention mechanism and a GCN, and the method is specifically implemented according to the following steps: firstly, carrying out the preprocessing of network flow data in an original csv format, and coding a label of the flow; combining and screening the preprocessed data to form new features, then combining the features with the remaining features to obtain a new data set, and dividing the data set into a training set and a test set; constructing a network traffic feature extraction model EResGAT and a network traffic classification model GCN; and training the network traffic classification model GCN to obtain a trained classification model, thereby solving the problem of poor malicious traffic identification accuracy caused by the fact that machine learning and deep learning methods in the prior art only pay attention to the characteristics of the traffic because of neglecting the relationship between the traffic.

Description

Technical Field

[0001] The present invention belongs to the technical field of network and information security intrusion detection, and specifically relates to a network intrusion detection method based on a graph attention mechanism combined with GCN. Background Art

[0002] With the development of the Internet and the explosion of big data, network security has received more and more attention in contemporary society. In the past few years, the frequency and complexity of network attacks have increased significantly, posing a research challenge. Intrusion detection is a model for identifying potential malicious traffic and plays a vital role in network security. In the past, researchers mostly designed intrusion detection models through machine learning and basic deep learning methods. However, due to certain limitations of machine learning, the network traffic characteristics in the field of intrusion detection are usually complex and high-dimensional, and the data sets in this field are usually unbalanced. Machine learning cannot capture the changes in data in time and space well, which leads to insufficient generalization and accuracy of machine learning in the direction of intrusion detection. In contrast, the data in intrusion detection can usually be represented as a graph structure, and the complex relationship between network traffic can be captured through graph neural networks.

[0003] Graph neural networks (GNNs) are designed to encode non-Euclidean data, such as social networks, biological networks, and citation networks, to facilitate representation learning, downstream classification, and prediction tasks. Graph structured data usually contains node and edge features. Effective GNNs can not only learn feature embedding, but also capture spatial information hidden in the graph topology. Intrusion detection problems are usually performed on network flow data, which consists of IP addresses, port numbers, and a set of flow-related features (flow duration, number of transmitted packets, transmission rate, etc.). GNNs provide a perfect application environment for intrusion detection problems by simply mapping IP addresses and ports to nodes, while network flows can be mapped to edges. However, ordinary GNN models are not enough to fully capture the relationship and features between network nodes. In various existing network scenarios, network attacks are highly concealed, the number of network attack types is large, and the data quality is not high, resulting in insufficient accuracy of network intrusion detection in multiple attack scenarios. The network intrusion detection method based on the graph attention mechanism combined with GCN can more comprehensively capture the features and structures in the graph, thereby improving the accuracy and robustness of intrusion detection, which can help solve these problems to a certain extent. Here, GCN is a type of graph neural network model that GNN refers to.

[0004] At present, most of the methods for network intrusion detection are machine learning and simple deep learning methods, and the data feature dimensions used for training are too high and contain some useless features. However, these methods ignore the relationship between traffic and the importance of different features in traffic, and cannot comprehensively capture the contextual features between traffic data generated by network attacks, resulting in poor accuracy in network attack detection. Summary of the invention

[0005] The purpose of the present invention is to provide a network intrusion detection method based on a graph attention mechanism combined with GCN, which solves the problem of poor accuracy in identifying malicious traffic due to the machine learning and deep learning methods in the prior art ignoring the relationship between traffic and only focusing on the characteristics of the traffic itself.

[0006] The technical solution adopted by the present invention is a network intrusion detection method based on the graph attention mechanism combined with GCN, which is specifically implemented in the following steps:

[0007] Step 1: Preprocess the original CSV format network traffic data and encode the traffic labels;

[0008] Step 2: Combine and filter the preprocessed data to form a new feature, then combine the feature with the remaining features to obtain a new data set, and divide the data set into a training set and a test set;

[0009] Step 3: Build the network traffic feature extraction model EResGAT, input the converted training set, and extract the features between the context flows corresponding to each flow as a new training set;

[0010] Step 4: Build a network traffic classification model GCN;

[0011] Step 5: Train the network traffic classification model GCN to obtain a trained classification model;

[0012] Step 6: Evaluate the performance of the classification model.

[0013] The present invention is also characterized in that:

[0014] Step 1 is implemented according to the following steps:

[0015] Replace all inf values ​​and nan values ​​in the original data features with 0; map all IP addresses in the original data features to randomly assigned IP addresses; encode the label features in the original traffic through label encoding, and use the encoding results to refer to the specific traffic type.

[0016] Step 2 is implemented as follows:

[0017] Step 2.1, combine and filter the features containing IP addresses or ports in the data processed in step 1 to form new features, namely, Srate and Drate. The two features Srate and Drate are integers containing IP addresses and ports in the original pcap data packets obtained by the public data set CICIoT 2023 through feature extraction tools. Add the Srate feature and the Drate feature to the packet transmission rate Srate of the source IP as a new feature, and then use the packet header length Header_Length as another filtered feature. Combine these two features with the remaining features to form new traffic data;

[0018] Step 2.2: Use the new traffic data processed in step 2.1 as a data set sample, and divide the data set sample into a training set and a test set;

[0019] Step 2.3: Use the from_pandas_edgelist method in the networkx library to construct an undirected graph for all the traffic data in the training set and the test set, and then create a graph G from the constructed undirected graph according to the from_networkx method in the DGL library. The graph G1 obtained from all the traffic data in the training set is the training graph, and the graph G2 obtained from all the traffic data in the test set is the test graph. The training graph and test graph here correspond to the subsequent training set and test set to meet the subsequent model input needs;

[0020] Step 2.4: Expand the elements of the training graph G1 and the test graph G2 created in step 2.3 to obtain expanded training graphs and test graphs.

[0021] In step 2.3, all the traffic data in the training set and the test set are used to construct an undirected graph through the from_pandas_edgelist method in the networkx library. The specific process is as follows:

[0022] The df attribute is the table data converted from the 47 columns of features of the traffic data in the training set or test set, which contains Srate and Header_Length obtained by combined screening. The df attribute represents the data to be converted into a graph. The format is DataFrame. The table data has 47 columns of features and the number of rows is the number of traffic data in the training set or test set. One data corresponds to one row.

[0023] The source attribute is Header_Length in the table data. The source attribute is the valid column name of the source node in the constructed undirected graph in df;

[0024] The target attribute is the Srate in the table data. The target attribute is the valid column name of the target node in the constructed undirected graph in df;

[0025] The edge_attr attribute is the 44 column features and Label feature in df excluding Header_Length, Srate, and Label features. The edge_attr attribute is the feature of the edge corresponding to the source node and the target node in the constructed undirected graph, that is, the edge feature;

[0026] The create_using attribute is MultiGraph();

[0027] By setting the corresponding properties, you can get an undirected graph.

[0028] The graph G created in step 2.3 includes the number of nodes num_nodes, the number of edges num_edges, the format of all attributes of the nodes ndata_schemes, the format of all attributes of the edges edata_schemes, the object ndata containing all nodes, and the object edata containing all edges.

[0029] Step 2.4 is as follows:

[0030] Add an attribute h2 to ndata. The value of h2 is a numeric matrix with all values ​​of 3. The number of rows in the numeric matrix is ​​num_nodes, and the number of columns is the same as the number of features in df except for Header_Length, Srate, and Label. Attribute h2 corresponds to the features of all nodes in graph G.

[0031] edata is obtained from the edge_attr attribute when creating a graph based on the networkx and DGL libraries. Specifically, the attributes h1 and L of edata are generated corresponding to the content of the edge_attr attribute, where h1 represents the features of all edges in the graph, corresponding to the features in df in the edge_attr attribute except for Header_Length, Srate, and Label features. The L attribute represents all edges in the graph, that is, the labels corresponding to all flows, corresponding to the Label feature in the edge_attr attribute;

[0032] edata_schemes has generated attributes S1 and label when creating a graph based on networkx and DGL libraries. S1 represents the shape of the features stored in any single edge in the graph, and label represents the format of the label corresponding to each edge.

[0033] ndata_schemes is initially empty. After adding attribute h2 to ndata as mentioned above, a new attribute S2 is generated in ndata_schemes. Attribute S2 represents the shape of the features stored in any single node in the graph. At this point, the graph G has been expanded. The number of edges in the graph corresponds to the total number of traffic in the initial data set; the number of nodes corresponds to the number of non-repeated Header_Length and Srate tuples in all traffic.

[0034] Step 3 is as follows:

[0035] Step 3.1: The training graph and test graph obtained in step 2 are called bipartite graphs, where the edges directly connecting any two nodes in the bipartite graph are used as nodes in the line graph. If there are common nodes between the source nodes and the destination nodes of the two edges in the bipartite graph, the nodes corresponding to the two edges in the line graph are connected to form a new graph structure, namely, a line graph. The line graphs of the corresponding training graph and test graph are obtained respectively as the training set and test set for subsequent model input;

[0036] Step 3.2: Construct a feature extraction model. EResGAT introduces a residual structure based on GAT. The input of the EResGAT model is the training set and test set constructed in step 3.1. For each node v in the graph, the weighted average of adjacent features is first calculated, and then combined with the converted node feature e v The converted node features correspond to the edge edge_attr attribute of the node v in the graph G constructed in step 2. At the kth layer of node aggregation features, the attention-based aggregation features with residuals As shown in Formula 1:

[0037]

[0038] Among them, N v is the value range of node v’s neighbor node u, α uv is assigned to edge e in the line graph uv The attention coefficient, σ is the activation function, || represents serial concatenation, e v is the feature of node v, W is the cross-layer weight matrix, and W′ is the weight matrix of the layer where node v is located, mapping the input feature to a lower dimension. Attention coefficient α uv It can be simply through a feedforward neural network a[Wh u ||Wh v ] to learn, where a is a weight vector. Then the attention coefficients of all node pairs are obtained through LeakyRELU activation and softmax function, as shown in Formula 2:

[0039]

[0040] Multi-head attention is used to increase the capacity of the EResGAT model. The multi-head EResGAT aggregation expression is shown in Formula 3:

[0041]

[0042] Among them, there are M attention heads, is the mth attention coefficient, W m Corresponding to the mth weight matrix, at the end, the original node feature e v Connect the result of the product with W′;

[0043] Step 3.3: After step 3.2, extract the features between the context traffic of the network traffic corresponding to the linear graph, take the training set and test set constructed in step 3.1 as input, and generate a new data set, including the training set Train and the test set Test.

[0044] Step 4 is as follows:

[0045] Construct a network traffic classification model GCN. Use the data set corresponding to the features extracted in step 3 to convert it into an adjacency matrix structure, where the rows and columns of the matrix correspond to the non-repeated values ​​of the Srate and Header_Length features in step 2.1. If the values ​​corresponding to Srate and Header_Length exist in a piece of data in the network traffic, set the matrix position value corresponding to the row and column in the matrix to 1. Then construct a multi-layer GCN model to identify and classify various attack traffic in the network traffic.

[0046] The multi-layer GCN is described as follows:

[0047]

[0048] Among them, H (l) is the activation matrix of the lth layer in GCN, W (l) is the trainable weight matrix of the lth layer, σ(·) is the activation function, and the number of hidden layer units in the CGN is marked as h, l∈{1,2,...,L}, is the constructed neighbor matrix, for The GCN model consists of 1 input layer, L=4 hidden layers, 4 Dropout layers and 1 Dense layer.

[0049] Step 5 is as follows:

[0050] The adjacency matrix corresponding to the training set Train in the new data set constructed in step 3.3 is input into the network traffic classification model GCN constructed in step 4 for training. First, it passes through the input layer, and the input data format meets the format requirements of the input layer. Then it loops through 4 hidden layers and the Dropout layer, and finally outputs the classification result through the Dense layer. At this point, the classification model corresponding to the training set has been trained and a trained classification model is obtained.

[0051] Step 6 is as follows:

[0052] The new test set Test after extracting features from the test set in step 2 through the model EResGAT is used to obtain the adjacency matrix obtained by the adjacency matrix construction method in step 4 as the classification test in the trained GCN model in step 5.

[0053] The beneficial effect of the present invention is that the network intrusion detection method based on the graph attention mechanism combined with GCN uses EResGAT for feature extraction after processing the original network traffic data before model training, which effectively solves the problem of high dimension of network traffic feature vectors. Through the graph attention mechanism, it is possible to adaptively focus on the important features of the nodes, thereby more effectively representing high-dimensional sparse features. In terms of input graph construction of the feature extraction model, the inherent bipartite graph structure is changed and converted into a line graph. The advantage of this is that the complete network topology information can be retained, which helps to extract more complete data features. After obtaining the traffic feature data, the adjacency matrix of the corresponding data is constructed as the input of the classification model GCN, focusing on the relationship between network traffic data, improving the accuracy of intrusion detection, and providing reliable protection for intrusion detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 It is a flow chart of the network intrusion detection method based on the graph attention mechanism combined with GCN of the present invention;

[0055] Figure 2 This is the confusion matrix diagram corresponding to the experiment based on the public dataset CICIot 2023. DETAILED DESCRIPTION

[0056] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0057] The network intrusion detection method of the present invention is based on the graph attention mechanism combined with GCN. The flowchart is as follows Figure 1 As shown, the specific implementation steps are as follows:

[0058] Step 1: Preprocess the original network traffic data in csv format, replace the infinite values ​​and missing values ​​nan in the data, and encode the traffic labels;

[0059] Step 1 is implemented according to the following steps:

[0060] Replace all inf values ​​and nan values ​​in the original data features with 0; map all IP addresses in the original data features to randomly assigned IP addresses; encode the label features in the original traffic (the label features correspond to the labels of each traffic) by the label encoding method, and use the encoding results to refer to the specific traffic type. In the present invention, the traffic labels corresponding to the public experimental data set include one normal traffic and seven abnormal traffic, specifically: Benign (normal traffic), DDoS-ACK, DDoS-ICMP-Flood, DDoS-SYN-Flood, DDoS-SlowLoris, DoS-HTTP-Flood, DoS-UDP-Flood, VulnerabilityScan. Encode the labels of these eight types of traffic in order as 0-7.

[0061] Step 2: Combine and filter the features belonging to the IP address or port in the preprocessed data to form a new feature, then combine the feature with the remaining features to obtain a new data set, and divide the data set into a training set and a test set;

[0062] Step 2 is implemented as follows:

[0063] Step 2.1. Combine and filter the features containing IP addresses or ports in the data processed in step 1 to form new features, which correspond to the two features Srate and Drate in the final experimental data of this article. The two features Srate and Drate are integers containing IP addresses and ports in the original pcap data packets obtained by the feature extraction tool of the public data set CICIoT 2023. Add the Srate feature and the Drate feature and assign them to the packet transmission rate Srate of the source IP as a new feature, and then use the packet header length Header_Length as another filtered feature, because the header length of the data packet is an important feature. It is very helpful to identify network attack traffic. Generally, attack traffic contains a different packet header length from normal traffic. Combine these two features with the remaining features (since each traffic in the above public data set has 47 features, excluding the Srate feature obtained by addition, 45 features remain) to form new traffic data;

[0064] Step 2.2: Use the new traffic data processed in step 2.1 as a data set sample, and divide the data set sample into a training set and a test set;

[0065] Step 2.3: Use the from_pandas_edgelist method in the networkx library to construct an undirected graph for all the traffic data in the training set and the test set, and then create a graph G from the constructed undirected graph according to the from_networkx method in the DGL library. The graph G1 obtained from all the traffic data in the training set is the training graph, and the graph G2 obtained from all the traffic data in the test set is the test graph. The training graph and test graph here correspond to the subsequent training set and test set to meet the subsequent model input needs;

[0066] Step 2.4: Expand the elements of the training graph G1 and the test graph G2 created in step 2.3 to obtain expanded training graphs and test graphs.

[0067] In step 2.3, all the traffic data in the training set and the test set are used to construct an undirected graph through the from_pandas_edgelist method in the networkx library. The specific process is as follows:

[0068] The df attribute is the table data converted from the 47 columns of features of the traffic data in the training set or test set, which contains Srate and Header_Length obtained by combined screening. The df attribute represents the data to be converted into a graph. The format is DataFrame. The table data has 47 columns of features and the number of rows is the number of traffic data in the training set or test set. One data corresponds to one row.

[0069] The source attribute is Header_Length in the table data. The source attribute is the valid column name of the source node in the constructed undirected graph in df;

[0070] The target attribute is the Srate in the table data. The target attribute is the valid column name of the target node in the constructed undirected graph in df;

[0071] The edge_attr attribute is the 44 column features and Label feature in df excluding Header_Length, Srate, and Label features. The edge_attr attribute is the feature of the edge corresponding to the source node and the target node in the constructed undirected graph, that is, the edge feature;

[0072] The create_using attribute is MultiGraph();

[0073] By setting the corresponding properties, you can get an undirected graph.

[0074] The graph G created in step 2.3 includes the number of nodes num_nodes, the number of edges num_edges, the format of all node attributes ndata_schemes, the format of all edge attributes edata_schemes, the object ndata containing all nodes, and the object edata containing all edges. (The graph G is constructed by the from_pandas_edgelist method in the networkx library, and the constructed graph contains all the above attributes)

[0075] Step 2.4 is as follows:

[0076] Add an attribute h2 to ndata. The value of h2 is a numeric matrix with all 3s. The number of rows in the numeric matrix is ​​num_nodes, and the number of columns is the same as the number of features in df excluding Header_Length, Srate, and Label, that is, 44. Attribute h2 corresponds to the features of all nodes in graph G;

[0077] edata is obtained from the edge_attr attribute when creating a graph based on the networkx and DGL libraries. Specifically, the attributes h1 and L of edata are generated corresponding to the content of the edge_attr attribute, where h1 represents the features of all edges in the graph, corresponding to the features in df in the edge_attr attribute except for Header_Length, Srate, and Label features. The L attribute represents all edges in the graph, that is, the labels corresponding to all flows, corresponding to the Label feature in the edge_attr attribute;

[0078] edata_schemes has generated attributes S1 and label when creating a graph based on networkx and DGL libraries. S1 represents the shape of the feature stored in any single edge in the graph, i.e. (1, 44), and label represents the format of the label corresponding to each edge.

[0079] ndata_schemes is initially empty. After adding attribute h2 to ndata as mentioned above, a new attribute S2 is generated in ndata_schemes. Attribute S2 represents the shape of the feature stored in any single node in the graph, that is, (1, 44). At this point, the graph G has been expanded. The number of edges in the graph corresponds to the total number of traffic in the initial data set; the number of nodes corresponds to the number of non-repeated Header_Length and Srate tuples in all traffic.

[0080] Step 3: Build the network traffic feature extraction model EResGAT, input the converted training set, and extract the features between the context flows corresponding to each flow as a new training set;

[0081] Step 3 is as follows:

[0082] Step 3.1: The training graph and test graph obtained in step 2 are called bipartite graphs. Since the source address and destination address of the traffic are disjoint in all traffic data, the bipartite graph can be easily converted into a corresponding line graph, where the edges directly connecting any two nodes in the bipartite graph are used as nodes in the line graph. If there are common nodes between the source nodes and the destination nodes of the two edges in the bipartite graph, the nodes corresponding to the two edges in the line graph are connected to form a new graph structure, namely a line graph, and the line graphs of the corresponding training graph and test graph are obtained respectively as the training set and test set for the subsequent model input. The advantage of this graph conversion method is that it allows the characteristics of the traffic to be associated with each node of the graph instead of the edge, and the network topology information will not be lost. The subsequent model only needs to convert the edge prediction of the graph to the node prediction.

[0083] Step 3.2: Construct a feature extraction model. EResGAT introduces a residual structure based on GAT. The input of the EResGAT model is the training set and test set (line graph) constructed in step 3.1. For each node v in the graph, the weighted average of adjacent features is first calculated, and then combined with the converted node feature e v The converted node features correspond to the edge edge_attr attributes of the nodes v in the graph G constructed in step 2, because the edge features of the bipartite graph correspond to the node features of the line graph. This processing method is suitable for highly unbalanced data in intrusion detection, because it can prevent the performance from being affected when the neighborhood of the node is mostly occupied by the majority class and the node embedding is not well represented. At the kth layer of node aggregation features, the attention-based aggregation feature h with residual v k As shown in Formula 1:

[0084]

[0085] Among them, N v is the value range of node v’s neighbor node u, α uv is assigned to edge e in the line graph uv The attention coefficient, σ is the activation function, || represents serial concatenation, e v is the feature of node v, W is the cross-layer weight matrix, and W′ is the weight matrix of the layer where node v is located, mapping the input feature to a lower dimension. Attention coefficient α uv It can be simply through a feedforward neural network a[Wh u ||Wh v ] to learn, where a is a weight vector. Then the attention coefficients of all node pairs are obtained through LeakyRELU activation and softmax function, as shown in Formula 2:

[0086]

[0087] Similar to GAT, multi-head attention is used to increase the capacity of the EResGAT model. In the experiment, M=3 attention heads are used. Therefore, the multi-head EResGAT aggregation expression is shown in Formula 3:

[0088]

[0089] Among them, there are M attention heads, is the mth attention coefficient, W m Corresponding to the mth weight matrix, the original node feature e is added at the end v Connect the result of the product with W′, such a change can be all M matrices W m The residual here is reflected in the fact that when aggregating each layer of neighbor features in Formula 1, the transformation of the original node features is connected, which is very similar to residual learning, where With a residual function F, the sum in the formula is replaced by concatenation. The purpose of this is to solve the problem that the embedding of neighbor nodes may be diluted during the aggregation process.

[0090] Step 3.3: After extracting the features between the context traffic of the network traffic corresponding to the linear graph in step 3.2, take the training set and test set (line graph) constructed in step 3.1 as input to generate a new data set, including the training set Train and the test set Test.

[0091] Step 4: Construct the adjacency matrix corresponding to the new data set as the input of the classification model and build the network traffic classification model GCN;

[0092] Step 4 is as follows:

[0093] Construct a network traffic classification model GCN, which is a convolutional neural network that directly acts on the graph and uses its structural information. By exploring the relationship between traffic, the data set corresponding to the features extracted in step 3 is converted into an adjacency matrix structure, which is also a storage method for graph structures. The rows and columns of the matrix correspond to the non-repeated values ​​in the Srate and Header_Length features in step 2.1. Because each traffic contains these two features, they can be used to identify the rows and columns of the matrix. If the values ​​corresponding to Srate and Header_Length exist in a piece of data in the network traffic, the matrix position value corresponding to the row and column in the matrix is ​​set to 1, and then a multi-layer GCN model is constructed to identify and classify various attack traffic in the network traffic;

[0094] GCN is a valuable method for multiple classification of graph structure data. It is based on the first-order approximation of graph convolution and can effectively encode graph structure and node features. By consistently merging node features in the graph, it achieves excellent performance in various graph structure classifications. In GCN, the message passing method is weighted by the adjacency matrix. The multi-layer GCN is expressed as follows:

[0095]

[0096] Among them, H (l) is the activation matrix of the lth layer in GCN, W (l) is the trainable weight matrix of the lth layer, σ(·) is the activation function, and the number of hidden layer units in the CGN is marked as h, l∈{1,2,...,L}, is the constructed neighbor matrix, for The degree matrix of the GCN model is composed of 1 input layer, L=4 hidden layers, 4 Dropout layers and 1 Dense layer, where the value of h is 32.

[0097] Step 5: Use the training set obtained in step 3 to train the network traffic classification model GCN constructed in step 4 to obtain a trained classification model;

[0098] Step 5 is as follows:

[0099] The adjacency matrix corresponding to the training set Train in the new data set constructed in step 3.3 is input into the network traffic classification model GCN constructed in step 4 for training. First, it passes through the input layer, and the input data format meets the format requirements of the input layer. Then it loops through 4 hidden layers and the Dropout layer. The Dropout layer is to prevent the model from overfitting, and the features are randomly set to 0 with a specified drop probability of 0.5. Finally, the classification result is output through the Dense layer. The output of the Dense layer here is the number of traffic analogies in the data set, which corresponds to the 8 categories of the data set in this article. At this point, the classification model corresponding to the training set has been trained, and a trained classification model is obtained.

[0100] Step 6: Evaluate the performance of the classification model.

[0101] Step 6 is as follows:

[0102] The new test set Test after extracting features through the model EResGAT in step 2 is used to construct the adjacency matrix obtained by the adjacency matrix construction method in step 4 as the classification test in the trained GCN model in step 5. The classification model is evaluated by using confusion matrix diagram, accuracy, recall rate, and F1-score.

[0103] In the future, the method proposed in this invention can also be applied to actual intrusion detection systems to detect network attack traffic in real time. The specific process is to collect pcap traffic data packets in the network, classify and predict them according to the processing process in the article, and see whether the traffic at each moment is abnormal traffic generated by network attacks.

[0104] Example 1

[0105] The network intrusion detection method based on graph attention mechanism combined with GCN has a flowchart as follows: Figure 1 As shown, the specific implementation steps are as follows:

[0106] Step 1, collect the data set. This article uses the public data set CICIoT 2023. The traffic data is in the form of a csv file; it includes 8 types of network traffic data, namely normal background traffic and DDoS attack traffic targeting the ACK field, ICMP flood attack traffic, SYN flood attack traffic, DDoS attack traffic for slow HTTP requests, DoS flood attack traffic for HTTP, DoS flood attack traffic for UDP, and network vulnerability scanning abnormal traffic.

[0107] The dataset preprocessing process is to replace all inf values ​​and nan values ​​in the original data features with 0; map all IP addresses in the original data features to randomly assigned IP addresses; encode the label features through label encoding, and use the encoding results to refer to the specific traffic type.

[0108] Step 2: Combine and filter the features belonging to the IP address or port in the preprocessed data to form a new feature, then combine the feature with the remaining features to obtain a new data set, and divide the data set into a training set and a test set; specifically:

[0109] Step 2.1, combine and filter the features containing IP addresses or ports in the data processed in step 1 to form new features, which correspond to the two features Srate and Drate in the final experimental data of this article. These two features are the public data set that uses feature extraction tools to calculate the IP addresses and ports in the original pcap data packets through a series of calculations, and finally generate integer numbers, which meets the requirements of filtering features. Add these two features and assign them to Srate as a new feature, and then use Header_Length as another filtered feature, because the header length of the data packet is an important feature, which is very helpful for identifying network attack traffic. Generally, attack traffic contains a different packet header length from normal traffic. Combine these two features with the remaining features to form new traffic data.

[0110] Step 2.2, taking all the traffic data processed in step 2.1 as data set samples, and dividing the data set samples into a training set and a test set;

[0111] Step 2.3, construct an undirected graph using the from_pandas_edgelist method in the networkx library for all the traffic data in the training set and the test set, and then create a graph G using the from_networkx method in the DGL library. The graph G obtained from all the traffic data in the training set is the training graph, and the graph G obtained from all the traffic data in the test set is the test graph. The training graph and test graph here correspond to the subsequent training set and test set to meet the subsequent model input needs;

[0112] In step 2.4, elements of the graph G corresponding to the training graph and the test graph created in step 2.3 are respectively expanded to obtain the expanded graph G, that is, the expanded training graph and the test graph.

[0113] In step 2.3, all the traffic data in the training set and the test set are used to construct an undirected graph through the from_pandas_edgelist method in the networkx library:

[0114] The df attribute is the table data converted from the 47 columns of features of the traffic data in the training set or test set (including Srate and Header_Length obtained by combined screening). The df attribute represents the data that needs to be converted into a graph. The format is DataFrame. The table data has 47 columns of features and the number of rows is the number of traffic data in the training set or test set. One data corresponds to one row.

[0115] The source attribute is Header_Length in the table data. The source attribute is the valid column name of the source node in the constructed undirected graph in df;

[0116] The target attribute is the Srate in the table data. The target attribute is the valid column name of the target node in the constructed undirected graph in df;

[0117] The edge_attr attribute is the 44 column features and Label feature in df excluding Header_Length, Srate, and Label features. The edge_attr attribute is the feature of the edge corresponding to the source node and the target node in the constructed undirected graph, that is, the edge feature;

[0118] The create_using attribute is MultiGraph();

[0119] By setting the corresponding attributes, you can get an undirected graph;

[0120] The graph G created in step 2.3 includes the number of nodes num_nodes, the number of edges num_edges, the format of all attributes of the nodes ndata_schemes, the format of all attributes of the edges edata_schemes, the object ndata containing all nodes, and the object edata containing all edges.

[0121] Step 2.4 is as follows:

[0122] Add an attribute "h2" to ndata, whose value is a numeric matrix with all 3s. The number of rows in the numeric matrix is ​​num_nodes, and the number of columns is the same as the number of features in df excluding Header_Length, Srate, and Label, that is, 44. This attribute "h2" corresponds to the features of all nodes in graph G;

[0123] edata has been obtained from the edge_attr attribute when creating a graph based on the networkx and DGL libraries. Specifically, the attributes "h1" and "L" of edata are generated corresponding to the content of the edge_attr attribute, where "h1" represents the features of all edges in the graph, corresponding to the features in df in the edge_attr attribute except Header_Length, Srate, and Label features, and the "L" attribute represents all edges in the graph, that is, the labels corresponding to all flows, corresponding to the Label feature in the edge_attr attribute;

[0124] edata_schemes has generated the attributes "S1" and "label" when creating a graph based on the networkx and DGL libraries. "S1" represents the shape of the feature stored in any single edge in the graph, that is, (1, 44), and "label" represents the format of the label corresponding to each edge;

[0125] ndata_schemes is initially empty. After adding the attribute "h2" to ndata as mentioned above, a new attribute "S2" is generated in ndata_schemes, which represents the shape of the features stored in any single node in the graph, that is, (1, 44). At this point, the graph G has been expanded; the number of edges in the graph corresponds to the total number of traffic in the initial data set; the number of nodes corresponds to the number of non-repeated Header_Length and Srate tuples in all traffic.

[0126] Step 3: Build the network traffic feature extraction model EResGAT, input the converted training set, and extract the features between the context flows corresponding to each flow as a new training set; specifically:

[0127] Step 3.1: The training graph and test graph obtained in step 2 are called bipartite graphs. Since the source address and destination address of the traffic are disjoint in all traffic data, the bipartite graph can be easily converted into a corresponding line graph, where the edges directly connecting any two nodes in the bipartite graph are used as nodes in the line graph. If there are common nodes between the source nodes and the destination nodes of the two edges in the bipartite graph, the nodes corresponding to the two edges in the line graph are connected, which constitutes a new graph structure, namely a line graph. The line graphs corresponding to the training graph and the test graph are used as the training set and test set for the subsequent model input. The advantage of this graph conversion method is that it allows the characteristics of the traffic to be associated with each node of the graph, rather than the edge, and the network topology information will not be lost. The subsequent model will also need to convert the edge prediction of the graph to the node prediction.

[0128] Step 3.2: Construct a feature extraction model. EResGAT introduces a residual structure based on GAT. The input of the model is the training set and test set (line graph) constructed in step 3.1. For each node v in the graph, the weighted average of the adjacent features is first calculated, and then combined with the converted node feature e v Connection, where the converted node features correspond to the edge edge_attr attributes of the edge containing the v node in the graph constructed in step 2, because the edge features of the bipartite graph correspond to the node features of the line graph. This processing method is suitable for highly unbalanced data in intrusion detection, because it can prevent the performance from being affected when the neighborhood of the node is mostly occupied by the majority class and the node embedding is not well represented. At the kth layer of node aggregation features, the attention-based aggregation feature with residual As shown in Formula 1:

[0129]

[0130] Among them, N u is the value range of node v’s neighbor node u, α uv is assigned to edge e in the line graph uv The attention coefficient, σ is the activation function, || represents serial concatenation, e v is the feature of node v, W is the cross-layer weight matrix, and W′ is the weight matrix of the layer where node v is located, mapping the input feature to a lower dimension. Attention coefficient α uv It can be simply through a feedforward neural network a[Wh u ||Wh v ] to learn, where a is a weight vector. Then the attention coefficients of all node pairs are obtained through LeakyRELU activation and softmax function, as shown in Formula 2:

[0131]

[0132] Similar to GAT, multi-head attention is used to increase the capacity of the EResGAT model. In the experiment, M=3 attention heads are used. Therefore, the multi-head EResGAT aggregation expression is shown in Formula 3:

[0133]

[0134] There are M attention heads, is the mth attention coefficient, W m Corresponding to the mth weight matrix. At the end, the original node feature e v Connect the result of the product with W′, such a change can be all M matrices W m The residual here is reflected in the fact that when aggregating each layer of neighbor features in Formula 1, the transformation of the original node features is connected, which is very similar to residual learning, where With a residual function F, the sum in the formula is replaced by concatenation. The purpose of this is to solve the problem that the embedding of neighbor nodes may be diluted during the aggregation process.

[0135] Step 3.3: After step 3.2, the features between the context traffic of the network traffic corresponding to the linear graph can be extracted. The training set and test set (line graph) constructed in step 3.1 are used as input to generate a new data set, including a training set and a test set.

[0136] Step 4: construct the adjacency matrix corresponding to the new data set as the input of the classification model, and build the network traffic classification model GCN; specifically:

[0137] Construct a network traffic classification model GCN, which is a convolutional neural network that directly acts on the graph and uses its structural information. By exploring the relationship between traffic, the dataset corresponding to the features extracted in step 3 is converted into an adjacency matrix structure, which is also a storage method for graph structures. The rows and columns of the matrix correspond to the non-repeated values ​​of the Srate and Header_Length features in step 2.1 as the rows and columns in the matrix. If the values ​​corresponding to Srate and Header_Length exist in a piece of data in the network traffic, the matrix position value corresponding to the row and column in the matrix is ​​set to 1. Then build a multi-layer GCN model to identify and classify various attacks on network traffic.

[0138] GCN is a valuable method for multiple classification of graph structure data. It is based on the first-order approximation of graph convolution and can effectively encode graph structure and node features. By consistently merging node features in the graph, it achieves excellent performance in various graph structure classifications. In GCN, the message passing method is weighted by the adjacency matrix. The multi-layer GCN can be expressed as Formula 4.

[0139]

[0140] Among them, H (l) is the activation matrix of the lth layer in GCN, W (l) is the trainable weight matrix of the lth layer, σ(·) is the activation function. The number of hidden layer units in the CGN is marked as h, l∈{1,2,...,L}. is the constructed neighbor matrix, for The GCN model consists of 1 input layer, L=4 hidden layers, 4 Dropout layers and 1 Dense layer, where the value of h is 32.

[0141] Step 5: Use the training set obtained in step 3 to train the network traffic classification model GCN constructed in step 4 to obtain a trained classification model; specifically:

[0142] The adjacency matrix corresponding to the training set in the new data set constructed in step 4 is input into GCN for training. Through the algorithm in step 4, it first passes through the input layer. The input data format here meets the format requirements of the input layer. Then it loops through 4 hidden layers and the Dropout layer. The Dropout layer is to prevent the model from overfitting. It randomly sets the features to 0 with a specified drop probability of 0.5. Finally, the classification result is output through the Dense layer. The output of the Dense layer here is the number of traffic analogies in the data set, which corresponds to the 8 categories of the data set in this article. At this point, the classification model corresponding to the training set has been trained, and a trained classification model is obtained.

[0143] Step 6: The test set in step 2 is subjected to the adjacency matrix construction method in step 4 after extracting features through the model EResGAT, as a new test set, and then input into the trained classification model to evaluate the performance of the classification model; specifically:

[0144] The test set in step 2 is used as a new test set after extracting features through the model EResGAT, and then the adjacency matrix construction method in step 4 is used as the new test set, and then it is input into the classification model GCN trained in step 5 for classification test. The classification model is evaluated by using confusion matrix diagram, accuracy, recall rate, and F1-score.

[0145] Example 2

[0146] Based on Example 1, the Dropout layer will randomly discard some neurons during the training process to reduce the risk of overfitting. The discard ratio is set to 0.5, and the Dropout layer is closed after the model training is completed to ensure the accuracy of the model in testing or actual applications.

[0147] Example 3

[0148] Based on Example 2, in step 2.2, 80% of the samples in the data set are used as training sets, and 20% of the samples in the data set are used as test sets.

[0149] Example 4

[0150] Based on Example 3, this example selects the public data set CICIoT 2023, and selects eight types of network traffic with relatively balanced data volumes. The total number of traffic is 148,071, including 21,030 normal network traffic, 10,913 DDoS attack traffic for the ACK field, 23,706 ICMP flood attack traffic, 39,153 SYN flood attack traffic, 8,960 DDoS attack traffic for slow HTTP requests, 7,935 DoS flood attack traffic for HTTP, 25,790 DoS flood attack traffic for UDP, and 10,584 network vulnerability scanning abnormal traffic.

[0151] The method of the present invention is used to first train the adjacency matrix corresponding to 80% of all the data as the input of GCN, and then the adjacency matrix corresponding to the remaining 20% ​​of the processed data is constructed to test. The test results are as follows:

[0152] Table 1 Model evaluation indicators

[0153] Accuracy Recall F1 score Sample size Normal network traffic 0.9832 0.9832 0.9858 8412 ACK DDoS attack traffic 0.9915 0.9867 0.9891 4366 ICMP flood attack traffic 0.9973 0.9985 0.9979 9482 SYN flood attack traffic 0.9905 0.9937 0.9921 15662 Slow down the flow of HTTP requests 0.9634 0.9282 0.9445 3584 HTTP DoS attack traffic 0.9615 0.9282 0.9445 3174 UDP DoS attack traffic 0.9965 0.9961 0.9963 10316 Network vulnerability scanning abnormal traffic 0.9651 0.9665 0.9658 4234

[0154] The network traffic classification results of the eight types of data as shown in Table 1 are evaluated as follows. From the results in Table 1, it can be seen that the classification accuracy, recall rate, F1 score, etc. of the method of the present invention are close to 1. Figure 2 As shown in the figure, it is the confusion matrix corresponding to the classification result of the model in this embodiment. Figure 2 It can be seen that the model has high accuracy, which can prove that the present invention is effective in intrusion detection.

Claims

1. A network intrusion detection method based on graph attention mechanism combined with GCN, characterized by: Follow the steps below to implement it: Step 1: Preprocess the original CSV format network traffic data and encode the traffic labels; Step 2: Combine and filter the preprocessed data to form a new feature, then combine the feature with the remaining features to obtain a new data set, and divide the data set into a training set and a test set; Step 3: Build the network traffic feature extraction model EResGAT, input the converted training set, and extract the features between the context flows corresponding to each flow as a new training set; Step 4: Build a network traffic classification model GCN; Step 5: Train the network traffic classification model GCN to obtain a trained classification model; Step 6: Evaluate the performance of the classification model.

2. According to claim 1, the network intrusion detection method based on graph attention mechanism combined with GCN is characterized in that: The step 1 is specifically implemented according to the following steps: Replace all inf values ​​and nan values ​​in the original data features with 0; map all IP addresses in the original data features to randomly assigned IP addresses; encode the label features in the original traffic through label encoding, and use the encoding results to refer to the specific traffic type.

3. The network intrusion detection method based on graph attention mechanism combined with GCN according to claim 2 is characterized in that: The step 2 is specifically implemented according to the following steps: Step 2.1, combine and filter the features containing IP addresses or ports in the data processed in step 1 to form new features, namely, Srate and Drate. The two features Srate and Drate are integers containing IP addresses and ports in the original pcap data packets obtained by the public data set CICIoT 2023 through feature extraction tools. Add the Srate feature and the Drate feature to the packet transmission rate Srate of the source IP as a new feature, and then use the packet header length Header_Length as another filtered feature. Combine these two features with the remaining features to form new traffic data; Step 2.2: Use the new traffic data processed in step 2.1 as a data set sample, and divide the data set sample into a training set and a test set; Step 2.3: Use the from_pandas_edgelist method in the networkx library to construct an undirected graph for all the traffic data in the training set and the test set, and then create a graph G from the constructed undirected graph according to the from_networkx method in the DGL library. The graph G1 obtained from all the traffic data in the training set is the training graph, and the graph G2 obtained from all the traffic data in the test set is the test graph. The training graph and test graph here correspond to the subsequent training set and test set to meet the subsequent model input needs; Step 2.4: Expand the elements of the training graph G1 and the test graph G2 created in step 2.3 to obtain expanded training graphs and test graphs.

4. The network intrusion detection method based on graph attention mechanism combined with GCN according to claim 3 is characterized in that: In step 2.3, all the traffic data in the training set and the test set are respectively constructed into an undirected graph through the from_pandas_edgelist method in the networkx library. The specific process is as follows: The df attribute is the table data converted from the 47 columns of features of the traffic data in the training set or test set, which contains Srate and Header_Length obtained by combined screening. The df attribute represents the data to be converted into a graph. The format is DataFrame. The table data has 47 columns of features and the number of rows is the number of traffic data in the training set or test set. One data corresponds to one row. The source attribute is Header_Length in the table data. The source attribute is the valid column name of the source node in the constructed undirected graph in df; The target attribute is the Srate in the table data. The target attribute is the valid column name of the target node in the constructed undirected graph in df; The edge_attr attribute is the 44 column features and Label feature in df excluding Header_Length, Srate, and Label features. The edge_attr attribute is the feature of the edge corresponding to the source node and the target node in the constructed undirected graph, that is, the edge feature; The create_using attribute is MultiGraph(); By setting the corresponding properties, you can get an undirected graph.

5. The network intrusion detection method based on graph attention mechanism combined with GCN according to claim 3 is characterized in that: The graph G created in step 2.3 includes the number of nodes num_nodes, the number of edges num_edges, the format of all attributes of the nodes ndata_schemes, the format of all attributes of the edges edata_schemes, the object ndata containing all nodes, and the object edata containing all edges.

6. The network intrusion detection method based on graph attention mechanism combined with GCN according to claim 5 is characterized in that: The step 2.4 is specifically as follows: Add an attribute h2 to ndata. The value of h2 is a numeric matrix with all values ​​of 3. The number of rows in the numeric matrix is ​​num_nodes, and the number of columns is the same as the number of features in df except for Header_Length, Srate, and Label. Attribute h2 corresponds to the features of all nodes in graph G. edata is obtained from the edge_attr attribute when creating a graph based on the networkx and DGL libraries. Specifically, the attributes h1 and L of edata are generated corresponding to the content of the edge_attr attribute, where h1 represents the features of all edges in the graph, corresponding to the features in df in the edge_attr attribute except for Header_Length, Srate, and Label features. The L attribute represents all edges in the graph, that is, the labels corresponding to all flows, corresponding to the Label feature in the edge_attr attribute; edata_schemes has generated attributes S1 and label when creating a graph based on networkx and DGL libraries. S1 represents the shape of the features stored in any single edge in the graph, and label represents the format of the label corresponding to each edge. ndata_schemes is initially empty. After adding attribute h2 to ndata as mentioned above, a new attribute S2 is generated in ndata_schemes. Attribute S2 represents the shape of the features stored in any single node in the graph. At this point, the graph G has been expanded. The number of edges in the graph corresponds to the total number of traffic in the initial data set; the number of nodes corresponds to the number of non-repeated Header_Length and Srate tuples in all traffic.

7. The network intrusion detection method based on graph attention mechanism combined with GCN according to claim 6 is characterized in that: The step 3 is specifically as follows: Step 3.1: The training graph and test graph obtained in step 2 are called bipartite graphs, where the edges directly connecting any two nodes in the bipartite graph are used as nodes in the line graph. If there are common nodes between the source nodes and the destination nodes of the two edges in the bipartite graph, the nodes corresponding to the two edges in the line graph are connected to form a new graph structure, namely, a line graph. The line graphs of the corresponding training graph and test graph are obtained respectively as the training set and test set for subsequent model input; Step 3.2: Construct a feature extraction model. EResGAT introduces a residual structure based on GAT. The input of the EResGAT model is the training set and test set constructed in step 3.

1. For each node v in the graph, the weighted average of adjacent features is first calculated, and then combined with the converted node feature e v The converted node features correspond to the edge edge_attr attribute of the node v in the graph G constructed in step 2. At the kth layer of node aggregation features, the attention-based aggregation features with residuals As shown in Formula 1: Among them, N v is the value range of node v’s neighbor node u, α uv is assigned to edge e in the line graph uv The attention coefficient, σ is the activation function, || represents serial concatenation, e v is the feature of node v, W is the cross-layer weight matrix, W′ is the weight matrix of the layer where node v is located, which maps the input feature to a lower dimension, and the attention coefficient α uv It can be simply through a feedforward neural network a[Wh u ||Wh v ] to learn, where a is a weight vector, and then the attention coefficients of all node pairs are obtained through LeakyRELU activation and softmax function, as shown in Formula 2: Multi-head attention is used to increase the capacity of the EResGAT model. The multi-head EResGAT aggregation expression is shown in Formula 3: Among them, there are M attention heads, is the mth attention coefficient, W m Corresponding to the mth weight matrix, the original node feature e is added at the end v Connect the result of the product with W′; Step 3.3: After step 3.2, extract the features between the context traffic of the network traffic corresponding to the linear graph, take the training set and test set constructed in step 3.1 as input, and generate a new data set, including the training set Train and the test set Test.

8. The network intrusion detection method based on graph attention mechanism combined with GCN according to claim 7 is characterized in that: The step 4 is specifically as follows: Construct a network traffic classification model GCN. Use the data set corresponding to the features extracted in step 3 to convert it into an adjacency matrix structure, where the rows and columns of the matrix correspond to the non-repeated values ​​of the Srate and Header_Length features in step 2.

1. If the values ​​corresponding to Srate and Header_Length exist in a piece of data in the network traffic, set the matrix position value corresponding to the row and column in the matrix to 1. Then construct a multi-layer GCN model to identify and classify various attack traffic in the network traffic. The multi-layer GCN is described as follows: Among them, H (l) is the activation matrix of the lth layer in GCN, W (l) is the trainable weight matrix of the lth layer, σ(·) is the activation function, and the number of hidden layer units in the CGN is marked as h, l∈{1,2,...,L}, is the constructed neighbor matrix, for The GCN model consists of 1 input layer, L=4 hidden layers, 4 Dropout layers and 1 Dense layer.

9. The network intrusion detection method based on graph attention mechanism combined with GCN according to claim 8 is characterized in that: The step 5 is specifically as follows: The adjacency matrix corresponding to the training set Train in the new data set constructed in step 3.3 is input into the network traffic classification model GCN constructed in step 4 for training. First, it passes through the input layer, and the input data format meets the format requirements of the input layer. Then it loops through 4 hidden layers and the Dropout layer, and finally outputs the classification result through the Dense layer. At this point, the classification model corresponding to the training set has been trained and a trained classification model is obtained.

10. The network intrusion detection method based on graph attention mechanism combined with GCN according to claim 9 is characterized in that: The step 6 is specifically as follows: The new test set Test after extracting features from the test set in step 2 through the model EResGAT is used to obtain the adjacency matrix obtained by the adjacency matrix construction method in step 4 as the classification test in the trained GCN model in step 5.

Images