Network intrusion detection method based on graph attention mechanism combined with GCN

Abstract

The present invention discloses a network intrusion detection method based on a graph attention mechanism combined with GCN, which is specifically implemented in the following steps: first, preprocessing the original network traffic data in CSV format and encoding the traffic label; combining and screening the preprocessed data to form a new feature, then combining the feature with the remaining features to obtain a new data set, and dividing the data set into a training set and a test set; constructing a network traffic feature extraction model EResGAT and a network traffic classification model GCN; training the network traffic classification model GCN to obtain a trained classification model. The present invention solves the problem of poor accuracy in malicious traffic identification caused by machine learning and deep learning methods in the prior art because they ignore the relationship between traffic and only focus on the characteristics of the traffic itself.

Description

Technical Field

[0001] The present invention belongs to the technical field of network and information security intrusion detection, and specifically relates to a network intrusion detection method based on a graph attention mechanism combined with GCN. Background Art

[0002] With the development of the internet and the explosion of big data, network security has garnered increasing attention in contemporary society. Over the past few years, the frequency and complexity of cyberattacks have increased significantly, posing a significant research challenge. Intrusion detection, a model that identifies potentially malicious traffic, plays a crucial role in network security. In the past, researchers primarily designed intrusion detection models using machine learning and basic deep learning methods. However, due to limitations of machine learning, network traffic characteristics in the intrusion detection field are often complex and high-dimensional, and datasets in this field are often imbalanced. Machine learning cannot effectively capture temporal and spatial variations in data, resulting in insufficient generalization and accuracy for machine learning in intrusion detection. In contrast, data in intrusion detection can often be represented as graphs, and graph neural networks can capture the complex relationships between network traffic flows.

[0003] Graph neural networks (GNNs) are designed to encode non-Euclidean data, such as social networks, biological networks, and citation networks, to facilitate representation learning, downstream classification, and prediction tasks. Graph-structured data typically contains node and edge features. Effective GNNs can not only learn feature embeddings but also capture the spatial information hidden in the graph topology. Intrusion detection is often performed on network flow data, which consists of IP addresses, port numbers, and a set of flow-related features (flow duration, number of transmitted packets, transmission rate, etc.). GNNs simply map IP addresses and ports to nodes, while network flows can be mapped to edges, providing an ideal application for intrusion detection. However, conventional GNN models are insufficient to fully capture the relationships and features between network nodes. Existing network attacks in various network scenarios are highly concealed, with a large number of attack types and low data quality, resulting in insufficient accuracy for network intrusion detection in multiple attack scenarios. Network intrusion detection methods based on graph attention mechanisms combined with GCNs can more comprehensively capture the features and structure in the graph, thereby improving the accuracy and robustness of intrusion detection and, to a certain extent, can help address these issues. GCNs are a type of graph neural network model, which is a general term for GNNs.

[0004] Currently, most network intrusion detection methods rely on machine learning and simple deep learning approaches. The data used for training is often too high-dimensional and contains some useless features. However, these methods overlook the relationships between traffic flows and the importance of different features within traffic flows. They fail to fully capture the contextual characteristics of traffic data generated by network attacks, resulting in poor detection accuracy. Summary of the Invention

[0005] The purpose of this invention is to provide a network intrusion detection method based on the graph attention mechanism combined with GCN, which solves the problem of poor accuracy in identifying malicious traffic due to the poor accuracy of machine learning and deep learning methods in the existing technology, which ignore the relationship between traffic and only focus on the characteristics of the traffic itself.

[0006] The technical solution adopted by the present invention is a network intrusion detection method based on the graph attention mechanism combined with GCN, which is implemented in the following steps:

[0007] Step 1: Preprocess the original CSV format network traffic data and encode the traffic labels;

[0008] Step 2: Combine and filter the preprocessed data to form a new feature, then combine the feature with the remaining features to obtain a new dataset, and divide the dataset into a training set and a test set;

[0009] Step 3: Build the network traffic feature extraction model EResGAT, input the converted training set, and extract the features between the context flows corresponding to each flow as the new training set;

[0010] Step 4: Build the network traffic classification model GCN;

[0011] Step 5: Train the network traffic classification model GCN to obtain a trained classification model;

[0012] Step 6: Evaluate the performance of the classification model.

[0013] The present invention is also characterized in that:

[0014] Step 1 is implemented as follows:

[0015] Replace all inf and nan values ​​in the original data features with 0; map all IP addresses in the original data features to randomly assigned IP addresses; encode the label features in the original traffic using label encoding, and use the encoding results to refer to the specific traffic type.

[0016] Step 2 is implemented as follows:

[0017] Step 2.1: Combine and filter the features containing IP addresses or ports in the data processed in step 1 to form new features, namely, Srate and Drate. The Srate and Drate features are integers containing the IP addresses and ports in the original pcap data packets obtained by the feature extraction tool of the public dataset CICIoT 2023. Add the Srate and Drate features and assign them to the packet transmission rate Srate of the source IP as a new feature. Then, the packet header length Header_Length is used as another filtered feature. These two features are combined with the remaining features to form new traffic data.

[0018] Step 2.2: Use the new traffic data processed in step 2.1 as a data set sample, and divide the data set sample into a training set and a test set;

[0019] Step 2.3: Use the from_pandas_edgelist method in the networkx library to construct an undirected graph for all the traffic data in the training set and the test set, and then create a graph G from the constructed undirected graph using the from_networkx method in the DGL library. The graph G1 obtained from all the traffic data in the training set is the training graph, and the graph G2 obtained from all the traffic data in the test set is the test graph. The training graph and test graph here correspond to the subsequent training set and test set to meet the subsequent model input requirements;

[0020] Step 2.4: Expand the elements of the training graph G1 and the test graph G2 created in step 2.3 to obtain expanded training graphs and test graphs.

[0021] In step 2.3, all traffic data in the training set and test set are used to construct an undirected graph using the from_pandas_edgelist method in the networkx library. The specific process is as follows:

[0022] The df attribute is the tabular data converted from the 47 columns of traffic data in the training or test set, including Srate and Header_Length obtained by combined screening. The df attribute represents the data to be converted into a graph. The format is DataFrame. The tabular data has 47 columns of features and the number of rows is the number of traffic data items in the training or test set. One data item corresponds to one row.

[0023] The source attribute is Header_Length in the table data. The source attribute is the valid column name of the source node in the constructed undirected graph in df;

[0024] The target attribute is the Srate in the table data. The target attribute is the valid column name of the target node in the constructed undirected graph in df;

[0025] The edge_attr attribute is the 44 column features and Label feature in df excluding Header_Length, Srate, and Label features. The edge_attr attribute is the feature of the edge corresponding to the source node and the target node in the constructed undirected graph, that is, the edge feature;

[0026] The create_using attribute is MultiGraph();

[0027] By setting the corresponding properties, you can get an undirected graph.

[0028] The graph G created in step 2.3 includes the number of nodes num_nodes, the number of edges num_edges, the format of all node attributes ndata_schemes, the format of all edge attributes edata_schemes, the object ndata containing all nodes, and the object edata containing all edges.

[0029] Step 2.4 is as follows:

[0030] Add an attribute h2 to ndata. The value of h2 is a numeric matrix with all values ​​3. The number of rows in the numeric matrix is ​​num_nodes, and the number of columns is the same as the number of features in df excluding Header_Length, Srate, and Label. Attribute h2 corresponds to the features of all nodes in graph G.

[0031] edata is obtained from the edge_attr attribute when creating a graph based on the networkx and DGL libraries. Specifically, the attributes h1 and L of edata are generated according to the content of the edge_attr attribute, where h1 represents the features of all edges in the graph, corresponding to the features in df in the edge_attr attribute except for Header_Length, Srate, and Label features. The L attribute represents all edges in the graph, that is, the labels corresponding to all flows, corresponding to the Label feature in the edge_attr attribute;

[0032] edata_schemes has generated attributes S1 and label when creating a graph based on the networkx and DGL libraries. S1 represents the shape of the feature stored in any single edge in the graph, and label represents the format of the label corresponding to each edge.

[0033] ndata_schemes is initially empty. After adding the attribute h2 to ndata as mentioned above, a new attribute S2 is generated in ndata_schemes. Attribute S2 represents the shape of the feature stored in any single node in the graph. At this point, the graph G has been expanded. The number of edges in the graph corresponds to the total number of flows in the initial dataset. The number of nodes corresponds to the number of unique Header_Length and Srate tuples in all flows.

[0034] Step 3 is as follows:

[0035] Step 3.1: The training graph and test graph obtained in step 2 are called bipartite graphs. The edges directly connecting any two nodes in the bipartite graph are used as nodes in the line graph. If the source and destination nodes of two edges in the bipartite graph have a common node, the nodes corresponding to the two edges in the line graph are connected to form a new graph structure, namely the line graph. The corresponding line graphs of the training graph and the test graph are obtained respectively, which serve as the training set and test set for subsequent model input.

[0036] Step 3.2: Construct a feature extraction model. EResGAT introduces a residual structure based on GAT. The input of the EResGAT model is the training set and test set constructed in step 3.1. For each node v in the graph, the weighted average of the adjacent features is first calculated, and then combined with the converted node feature e v The converted node features correspond to the edge edge_attr attributes of the v node in the graph G constructed in step 2. At the kth layer of the node aggregation feature, the attention-based aggregation feature with residual As shown in Formula 1:

[0037]

[0038] Among them, N v is the value range of node v’s neighbor node u, α uv is assigned to edge e in the line graph uv The attention coefficient, σ is the activation function, || represents the serial splicing, e v is the feature of node v, W is the cross-layer weight matrix, and W′ is the weight matrix of the layer where node v is located, mapping the input feature to a lower dimension. Attention coefficient α uv It can be simply done through a feedforward neural network a[Wh u ||Wh v ] to learn, where a is a weight vector. Then the attention coefficients of all node pairs are obtained through LeakyRELU activation and softmax function, as shown in Formula 2:

[0039]

[0040] Multi-head attention is used to increase the capacity of the EResGAT model. The multi-head EResGAT aggregation expression is shown in Formula 3:

[0041]

[0042] Among them, there are M attention heads, is the mth attention coefficient, W m Corresponding to the mth weight matrix, the original node feature e is added at the end v Connect the result of the product with W′;

[0043] Step 3.3: After extracting the features between the contextual traffic of the network traffic corresponding to the linear graph in step 3.2, the training set and test set constructed in step 3.1 are used as input to generate a new data set, including the training set Train and the test set Test.

[0044] Step 4 is as follows:

[0045] Construct a GCN network traffic classification model. Use the dataset corresponding to the features extracted in step 3 to convert it into an adjacency matrix structure. The rows and columns of the matrix correspond to the unique values ​​of the Srate and Header_Length features in step 2.1. If the corresponding values ​​of Srate and Header_Length exist in a piece of network traffic, the matrix position value of the corresponding row and column in the matrix is ​​set to 1. Then, a multi-layer GCN model is constructed to identify and classify various attack traffic in the network traffic.

[0046] The multi-layer GCN is expressed as follows:

[0047]

[0048] Among them, H (l) is the activation matrix of the lth layer in GCN, W (l) is the trainable weight matrix of the lth layer, σ(·) is the activation function, and the number of hidden layer units in the CGN is marked as h, l∈{1,2,...,L}, is the constructed neighbor matrix, for The GCN model consists of 1 input layer, L=4 hidden layers, 4 Dropout layers and 1 Dense layer.

[0049] Step 5 is as follows:

[0050] The adjacency matrix corresponding to the training set Train in the new data set constructed in step 3.3 is input into the network traffic classification model GCN constructed in step 4 for training. First, it passes through the input layer, and the input data format meets the format requirements of the input layer. Then it loops through 4 hidden layers and the Dropout layer, and finally outputs the classification result through the Dense layer. At this point, the classification model corresponding to the training set has been trained and a trained classification model is obtained.

[0051] Step 6 is as follows:

[0052] The new test set Test after extracting features from the test set in step 2 through the model EResGAT is used to perform classification tests in the trained GCN model in step 5 by using the adjacency matrix obtained by the adjacency matrix construction method in step 4.

[0053] The beneficial effect of the present invention is that the network intrusion detection method based on the graph attention mechanism combined with GCN, before model training, the network raw traffic data is processed and EResGAT is used for feature extraction, which effectively solves the problem of high dimension of network traffic feature vectors. Through the graph attention mechanism, the important features of the nodes can be adaptively focused, thereby more effectively representing high-dimensional sparse features. In terms of constructing the input graph of the feature extraction model, the inherent bipartite graph structure is changed and converted into a line graph. The advantage of doing so is that the complete network topology information can be retained, which helps to extract more complete data features. After obtaining the traffic feature data, the adjacency matrix of the corresponding data is constructed as the input of the classification model GCN, focusing on the relationship between network traffic data, improving the accuracy of intrusion detection, and providing reliable protection for intrusion detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 This is a flow chart of the network intrusion detection method based on the graph attention mechanism combined with GCN in the present invention;

[0055] Figure 2 This is the confusion matrix diagram corresponding to the experiment based on the public dataset CICIot 2023. DETAILED DESCRIPTION

[0056] The present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0057] The present invention is based on a network intrusion detection method based on a graph attention mechanism combined with GCN. The flowchart is as follows: Figure 1 As shown, please follow the steps below:

[0058] Step 1: Preprocess the original CSV format network traffic data, replace the infinite values ​​and missing values ​​nan in the data, and encode the traffic labels;

[0059] Step 1 is implemented as follows:

[0060] Replace all inf values ​​and nan values ​​in the original data features with 0; map all IP addresses in the original data features to randomly assigned IP addresses; encode the label features in the original traffic (the label features correspond to the labels of each traffic) by the label encoding method, and use the encoding results to refer to the specific traffic type. In the present invention, the traffic labels corresponding to the public experimental data set include one normal traffic and seven abnormal traffic, specifically: Benign (normal traffic), DDoS-ACK, DDoS-ICMP-Flood, DDoS-SYN-Flood, DDoS-SlowLoris, DoS-HTTP-Flood, DoS-UDP-Flood, VulnerabilityScan. The labels of these eight types of traffic are encoded in order as 0-7.

[0061] Step 2: Combine and filter the features belonging to IP addresses or ports in the preprocessed data to form a new feature, then combine this feature with the remaining features to obtain a new dataset, and divide the dataset into a training set and a test set;

[0062] Step 2 is implemented as follows:

[0063] Step 2.1. Combine and filter the features containing IP addresses or ports in the data processed in step 1 to form new features, which correspond to the two features Srate and Drate in the final experimental data of this article. The two features Srate and Drate are integers containing the IP address and port in the original pcap data packet obtained by the feature extraction tool of the public dataset CICIoT 2023. Add the Srate feature and the Drate feature and assign them to the packet transmission rate Srate of the source IP as a new feature. Then use the packet header length Header_Length as another filtered feature, because the packet header length is an important feature. It is very helpful to identify network attack traffic. Generally, attack traffic contains a packet header length different from normal traffic. These two features are combined with the remaining features (since each traffic in the above public dataset has 47 features, excluding the Srate feature obtained by addition, 45 features remain) to form new traffic data;

[0064] Step 2.2: Use the new traffic data processed in step 2.1 as a data set sample, and divide the data set sample into a training set and a test set;

[0065] Step 2.3: Use the from_pandas_edgelist method in the networkx library to construct an undirected graph for all the traffic data in the training set and the test set, and then create a graph G from the constructed undirected graph using the from_networkx method in the DGL library. The graph G1 obtained from all the traffic data in the training set is the training graph, and the graph G2 obtained from all the traffic data in the test set is the test graph. The training graph and test graph here correspond to the subsequent training set and test set to meet the subsequent model input requirements;

[0066] Step 2.4: Expand the elements of the training graph G1 and the test graph G2 created in step 2.3 to obtain expanded training graphs and test graphs.

[0067] In step 2.3, all traffic data in the training set and test set are used to construct an undirected graph using the from_pandas_edgelist method in the networkx library. The specific process is as follows:

[0068] The df attribute is the tabular data converted from the 47 columns of traffic data in the training or test set, including Srate and Header_Length obtained by combined screening. The df attribute represents the data to be converted into a graph. The format is DataFrame. The tabular data has 47 columns of features and the number of rows is the number of traffic data items in the training or test set. One data item corresponds to one row.

[0069] The source attribute is Header_Length in the table data. The source attribute is the valid column name of the source node in the constructed undirected graph in df;

[0070] The target attribute is the Srate in the table data. The target attribute is the valid column name of the target node in the constructed undirected graph in df;

[0071] The edge_attr attribute is the 44 column features and Label feature in df excluding Header_Length, Srate, and Label features. The edge_attr attribute is the feature of the edge corresponding to the source node and the target node in the constructed undirected graph, that is, the edge feature;

[0072] The create_using attribute is MultiGraph();

[0073] By setting the corresponding properties, you can get an undirected graph.

[0074] The graph G created in step 2.3 includes the number of nodes (num_nodes), the number of edges (num_edges), the format of all node attributes (ndata_schemes), the format of all edge attributes (edata_schemes), the object ndata containing all nodes, and the object edata containing all edges. (Graph G is constructed using the from_pandas_edgelist method in the networkx library, and the constructed graph contains all of these attributes.)

[0075] Step 2.4 is as follows:

[0076] Add an attribute h2 to ndata. The value of h2 is a numeric matrix with all values ​​of 3. The number of rows in the numeric matrix is ​​num_nodes, and the number of columns is the same as the number of features in df excluding Header_Length, Srate, and Label, that is, 44. Attribute h2 corresponds to the features of all nodes in graph G.

[0077] edata is obtained from the edge_attr attribute when creating a graph based on the networkx and DGL libraries. Specifically, the attributes h1 and L of edata are generated according to the content of the edge_attr attribute, where h1 represents the features of all edges in the graph, corresponding to the features in df in the edge_attr attribute except for Header_Length, Srate, and Label features. The L attribute represents all edges in the graph, that is, the labels corresponding to all flows, corresponding to the Label feature in the edge_attr attribute;

[0078] When creating a graph using the networkx and DGL libraries, edata_schemes generates attributes S1 and label. S1 represents the shape of the feature stored in any single edge in the graph, i.e. (1, 44), and label represents the format of the label corresponding to each edge.

[0079] ndata_schemes is initially empty. After adding the attribute h2 to ndata as mentioned above, a new attribute S2 is generated in ndata_schemes. Attribute S2 represents the shape of the feature stored in any single node in the graph, that is, (1, 44). At this point, the graph G has been expanded. The number of edges in the graph corresponds to the total number of traffic in the initial dataset; the number of nodes corresponds to the number of non-repeated Header_Length and Srate tuples in all traffic.

[0080] Step 3: Build the network traffic feature extraction model EResGAT, input the converted training set, and extract the features between the context flows corresponding to each flow as the new training set;

[0081] Step 3 is as follows:

[0082] Step 3.1. The training graph and test graph obtained in step 2 are called bipartite graphs. Since the source address and destination address of the traffic are disjoint in all traffic data, the bipartite graph can be easily converted into a corresponding line graph, where the edge directly connecting any two nodes in the bipartite graph is used as a node in the line graph. If there is a common node between the source node and the destination node of two edges in the bipartite graph, the nodes corresponding to the two edges in the line graph are connected to form a new graph structure, namely a line graph. The line graphs of the corresponding training graph and test graph are obtained respectively, which serve as the training set and test set for the subsequent model input. The advantage of this graph conversion method is that it allows the characteristics of the traffic to be associated with each node of the graph instead of the edge, and the network topology information will not be lost. The subsequent model will also need to convert from edge prediction of the graph to node prediction.

[0083] Step 3.2: Construct a feature extraction model. EResGAT introduces a residual structure based on GAT. The input of the EResGAT model is the training set and test set (line graph) constructed in step 3.1. For each node v in the graph, the weighted average of the adjacent features is first calculated, and then combined with the converted node feature e v The converted node features correspond to the edge_attr attributes of the edge of the graph G constructed in step 2, which contains v nodes, because the edge features of the bipartite graph correspond to the node features of the line graph. This processing method is suitable for highly unbalanced data in intrusion detection because it can prevent the performance from being affected when the neighborhood of the node is mostly occupied by the majority class and the node embedding is not well represented. At the kth layer of node aggregation features, the attention-based aggregation feature h with residual v k As shown in Formula 1:

[0084]

[0085] Among them, N v is the value range of node v’s neighbor node u, α uv is assigned to edge e in the line graph uv The attention coefficient, σ is the activation function, || represents the serial splicing, e v is the feature of node v, W is the cross-layer weight matrix, and W′ is the weight matrix of the layer where node v is located, mapping the input feature to a lower dimension. Attention coefficient α uv It can be simply done through a feedforward neural network a[Wh u ||Wh v ] to learn, where a is a weight vector. Then the attention coefficients of all node pairs are obtained through LeakyRELU activation and softmax function, as shown in Formula 2:

[0086]

[0087] Similar to GAT, multi-head attention is used to increase the capacity of the EResGAT model. In the experiment, M=3 attention heads were used. Therefore, the multi-head EResGAT aggregation expression is shown in Formula 3:

[0088]

[0089] Among them, there are M attention heads, is the mth attention coefficient, W m Corresponding to the mth weight matrix, the original node feature e is added at the end v Connect the result of the product with W′, such a change can be all M matrices W m The residual here is reflected in the fact that when aggregating each layer of neighbor features in Formula 1, the transformation of the original node features is connected, which is very similar to residual learning, where With a residual function F, the summation in the formula is replaced by concatenation. The purpose of this is to solve the problem that the embedding of neighbor nodes may be diluted during the aggregation process.

[0090] Step 3.3: After extracting the features between the contextual traffic of the network traffic corresponding to the linear graph in step 3.2, take the training set and test set (line graph) constructed in step 3.1 as input to generate a new data set, including the training set Train and the test set Test.

[0091] Step 4: Construct the adjacency matrix corresponding to the new data set as the input of the classification model and build the network traffic classification model GCN;

[0092] Step 4 is as follows:

[0093] Construct a network traffic classification model, GCN. This is a convolutional neural network that directly acts on graphs and utilizes their structural information. By exploring the relationship between traffic flows, the dataset corresponding to the features extracted in step 3 is converted into an adjacency matrix structure. This is also a storage method for graph structures. The rows and columns of the matrix correspond to the unique values ​​of the Srate and Header_Length features in step 2.1. Because each traffic flow contains these two features, they can be used to identify the rows and columns of the matrix. If the corresponding values ​​of Srate and Header_Length exist in a piece of data in the network traffic, the matrix position value corresponding to the row and column in the matrix is ​​set to 1. Then, a multi-layer GCN model is constructed to identify and classify various attack flows in the network traffic.

[0094] GCN is a valuable method for multi-classification of graph-structured data. Based on the first-order approximation of graph convolution, it can effectively encode graph structure and node features. By consistently incorporating node features in the graph, it achieves excellent performance in various graph classifications. In GCN, message passing is weighted using an adjacency matrix. A multi-layer GCN is described as follows:

[0095]

[0096] Among them, H (l) is the activation matrix of the lth layer in GCN, W (l) is the trainable weight matrix of the lth layer, σ(·) is the activation function, and the number of hidden layer units in the CGN is marked as h, l∈{1,2,...,L}, is the constructed neighbor matrix, for The GCN model consists of 1 input layer, L=4 hidden layers, 4 Dropout layers and 1 Dense layer, where h is 32.

[0097] Step 5: Use the training set obtained in step 3 to train the network traffic classification model GCN constructed in step 4 to obtain a trained classification model;

[0098] Step 5 is as follows:

[0099] The adjacency matrix corresponding to the training set (Train) in the new dataset constructed in step 3.3 is input into the network traffic classification model GCN constructed in step 4 for training. First, the input data passes through the input layer, where the format meets the input layer's format requirements. It then loops through four hidden layers and a Dropout layer. The Dropout layer randomly sets features to 0 with a specified drop probability of 0.5 to prevent overfitting. Finally, the classification results are output through a Dense layer. The output of the Dense layer here is the number of traffic analogies in the dataset, corresponding to the eight categories in this dataset. At this point, the classification model for the training set has been trained, resulting in a trained classification model.

[0100] Step 6: Evaluate the performance of the classification model.

[0101] Step 6 is as follows:

[0102] The new test set Test after extracting features through the model EResGAT in step 2 is used to construct the adjacency matrix using the adjacency matrix construction method in step 4 as the training GCN model for classification test in step 5. The classification model is evaluated by using the confusion matrix diagram, accuracy, recall rate, and F1-score.

[0103] In the future, the method proposed in this invention can also be applied to actual intrusion detection systems to detect network attack traffic in real time. The specific process is to collect pcap traffic data packets in the network, classify and predict them according to the processing process in this article, and see whether the traffic at each moment is abnormal traffic generated by network attacks.

[0104] Example 1

[0105] The network intrusion detection method based on the graph attention mechanism combined with GCN has a flow chart as follows: Figure 1 As shown, please follow the steps below:

[0106] Step 1. Collect the data set. This article uses the public data set CICIoT 2023. The traffic data is in the form of a csv file; it includes 8 types of network traffic data, namely normal background traffic and DDoS attack traffic targeting the ACK field, ICMP flood attack traffic, SYN flood attack traffic, DDoS attack traffic of slow HTTP requests, DoS flood attack traffic targeting HTTP, DoS flood attack traffic targeting UDP, and network vulnerability scanning abnormal traffic.

[0107] The dataset preprocessing process is to replace all inf values ​​and nan values ​​in the original data features with 0; map all IP addresses in the original data features to randomly assigned IP addresses; encode the label features through label encoding, and use the encoding results to refer to specific traffic types.

[0108] Step 2: Combine and filter the features belonging to IP addresses or ports in the preprocessed data to form a new feature, then combine this feature with the remaining features to obtain a new dataset, and divide the dataset into a training set and a test set; specifically:

[0109] In step 2.1, combine and filter the features containing IP addresses or ports in the data processed in step 1 to form new features. These features correspond to the two features Srate and Drate in the final experimental data of this article. These two features are generated by the public dataset using a feature extraction tool. The IP addresses and ports in the original pcap packets are subjected to a series of calculations to generate integers, which meet the requirements for filtering features. These two features are added together and assigned to Srate as the new feature. Header_Length is then used as another filtered feature. This is because the packet header length is a key feature that is very helpful in identifying network attack traffic. Generally, attack traffic has a different packet header length than normal traffic. These two features are combined with the remaining features to form the new traffic data.

[0110] Step 2.2: All traffic data processed in step 2.1 are used as data set samples, and the data set samples are divided into training set and test set;

[0111] In step 2.3, all the traffic data in the training set and test set are used to construct an undirected graph using the from_pandas_edgelist method in the networkx library. Then, a graph G is created from the constructed undirected graph using the from_networkx method in the DGL library. The graph G obtained from all the traffic data in the training set is the training graph, and the graph G obtained from all the traffic data in the test set is the test graph. The training graph and test graph here correspond to the subsequent training set and test set to meet the subsequent model input requirements;

[0112] In step 2.4, the elements of the graph G corresponding to the training graph and the test graph created in step 2.3 are respectively expanded to obtain the expanded graph G, that is, the expanded training graph and the test graph.

[0113] In step 2.3, all traffic data in the training set and test set are used to construct an undirected graph using the from_pandas_edgelist method in the networkx library. Specifically:

[0114] The df attribute is the tabular data converted from the 47 columns of traffic data in the training or test set (including Srate and Header_Length obtained by combined screening). The df attribute represents the data to be converted into a graph. The format is DataFrame. The tabular data has 47 columns and the number of rows is the number of traffic data in the training or test set. One data item corresponds to one row.

[0115] The source attribute is Header_Length in the table data. The source attribute is the valid column name of the source node in the constructed undirected graph in df;

[0116] The target attribute is the Srate in the table data. The target attribute is the valid column name of the target node in the constructed undirected graph in df;

[0117] The edge_attr attribute is the 44 column features and Label feature in df excluding Header_Length, Srate, and Label features. The edge_attr attribute is the feature of the edge corresponding to the source node and the target node in the constructed undirected graph, that is, the edge feature;

[0118] The create_using attribute is MultiGraph();

[0119] By setting the corresponding attributes, you can get an undirected graph;

[0120] The graph G created in step 2.3 includes the number of nodes num_nodes, the number of edges num_edges, the format of all node attributes ndata_schemes, the format of all edge attributes edata_schemes, the object ndata containing all nodes, and the object edata containing all edges.

[0121] Step 2.4 is as follows:

[0122] Add an attribute "h2" to ndata. Its value is a numeric matrix with all 3s. The number of rows in the numeric matrix is ​​num_nodes, and the number of columns is the same as the number of features in df excluding Header_Length, Srate, and Label, that is, 44. This attribute "h2" corresponds to the features of all nodes in graph G.

[0123] edata is obtained from the edge_attr attribute when creating a graph using the networkx and DGL libraries. Specifically, the edata attributes "h1" and "L" are generated corresponding to the content of the edge_attr attribute. "h1" represents the features of all edges in the graph, corresponding to the features in the df in the edge_attr attribute except for the Header_Length, Srate, and Label features. The "L" attribute represents all edges in the graph, that is, the labels corresponding to all flows, corresponding to the Label feature in the edge_attr attribute.

[0124] When creating a graph using the networkx and DGL libraries, edata_schemes has generated the attributes "S1" and "label". "S1" represents the shape of the feature stored in any single edge in the graph, i.e. (1, 44), and "label" represents the format of the label corresponding to each edge.

[0125] ndata_schemes is initially empty. After adding the attribute "h2" to ndata as mentioned above, a new attribute "S2" is generated in ndata_schemes, which represents the shape of the features stored in any single node in the graph, that is, (1, 44). At this point, the graph G has been expanded; the number of edges in the graph corresponds to the total number of traffic in the initial dataset; the number of nodes corresponds to the number of non-repeated Header_Length and Srate tuples in all traffic.

[0126] Step 3: Build the network traffic feature extraction model EResGAT, input the converted training set, and extract the features between the context flows corresponding to each flow as a new training set; specifically:

[0127] Step 3.1: The training graph and test graph obtained in Step 2 are called bipartite graphs. Since the source and destination addresses of all traffic data are disjoint, the bipartite graph can be easily converted into a corresponding linear graph, where the edges directly connecting any two nodes in the bipartite graph serve as nodes in the linear graph. If the source and destination nodes of two edges in the bipartite graph share a common node, the nodes corresponding to these two edges in the linear graph are connected, forming a new graph structure, namely a linear graph. The linear graphs corresponding to the training and test graphs, respectively, serve as the training and test sets for subsequent model input. The advantage of this graph conversion method is that it allows traffic features to be associated with each node of the graph, rather than the edges, without losing network topology information. Subsequent models then need to convert from edge predictions to node predictions.

[0128] Step 3.2: Construct a feature extraction model. EResGAT introduces a residual structure based on GAT. The input of the model is the training set and test set (line graph) constructed in step 3.1. For each node v in the graph, the weighted average of the adjacent features is first calculated, and then combined with the transformed node feature e v Connection, where the converted node features correspond to the edge_attr attributes of the edge containing v nodes in the graph constructed in step 2, because the edge features of the bipartite graph correspond to the node features of the line graph. This processing method is suitable for highly unbalanced data in intrusion detection because it can prevent the performance from being affected when the neighborhood of the node is mostly occupied by the majority class and the node embedding is not well represented. At the kth layer of node aggregation features, the attention-based aggregation feature with residual As shown in Formula 1:

[0129]

[0130] Among them, N u is the value range of node v’s neighbor node u, α uv is assigned to edge e in the line graph uv The attention coefficient, σ is the activation function, || represents the serial splicing, e v is the feature of node v, W is the cross-layer weight matrix, and W′ is the weight matrix of the layer where node v is located, mapping the input feature to a lower dimension. Attention coefficient α uv It can be simply done through a feedforward neural network a[Wh u ||Wh v ] to learn, where a is a weight vector. Then the attention coefficients of all node pairs are obtained through LeakyRELU activation and softmax function, as shown in Formula 2:

[0131]

[0132] Similar to GAT, multi-head attention is used to increase the capacity of the EResGAT model. In the experiment, M=3 attention heads are used. Therefore, the multi-head EResGAT aggregation expression is shown in Formula 3:

[0133]

[0134] There are M attention heads, is the mth attention coefficient, W m Corresponding to the mth weight matrix. At the end, the original node feature e v Connect the result of the product with W′, such a change can be all M matrices W m The residual here is reflected in the fact that when aggregating each layer of neighbor features in Formula 1, the transformation of the original node features is connected, which is very similar to residual learning, where With a residual function F, the summation in the formula is replaced by concatenation. The purpose of this is to solve the problem that the embedding of neighbor nodes may be diluted during the aggregation process.

[0135] Step 3.3: After step 3.2, the features between the context traffic of the network traffic corresponding to the linear graph can be extracted. The training set and test set (line graph) constructed in step 3.1 are used as input to generate a new data set, including a training set and a test set.

[0136] Step 4: Construct the adjacency matrix corresponding to the new dataset as the input of the classification model and build the network traffic classification model GCN; specifically:

[0137] A network traffic classification model, GCN, is constructed. This is a convolutional neural network that directly operates on graphs and leverages their structural information. By exploring relationships between traffic flows, the dataset corresponding to the features extracted in step 3 is converted into an adjacency matrix structure, a storage method for graph structures. The rows and columns of the matrix correspond to the unique values ​​of the Srate and Header_Length features from step 2.1. If the corresponding values ​​of Srate and Header_Length exist in a piece of network traffic, the matrix position corresponding to that row and column is set to 1. A multi-layer GCN model is then constructed to identify and classify various attacks on network traffic.

[0138] GCN is a valuable method for multi-classification of graph-structured data. Based on a first-order approximation of graph convolution, it effectively encodes graph structure and node features. By consistently incorporating node features across the graph, it achieves excellent performance in various graph classification scenarios. In GCN, message passing is weighted using an adjacency matrix. A multi-layer GCN can be expressed as Equation 4.

[0139]

[0140] Among them H (l) is the activation matrix of the lth layer in GCN, W (l) is the trainable weight matrix of layer l, σ(·) is the activation function. Let h be the number of hidden units in CGN, l∈{1,2,...,L}. is the constructed neighbor matrix, for The GCN model consists of 1 input layer, L=4 hidden layers, 4 Dropout layers and 1 Dense layer, where h is 32.

[0141] Step 5: Use the training set obtained in step 3 to train the network traffic classification model GCN constructed in step 4 to obtain a trained classification model; specifically:

[0142] The adjacency matrix corresponding to the training set in the new dataset constructed in Step 4 is input into the GCN for training. The algorithm in Step 4 first passes through the input layer, where the input data format meets the input layer's format requirements. It then loops through four hidden layers and a dropout layer. The dropout layer randomly sets features to 0 with a dropout probability of 0.5 to prevent overfitting. Finally, the classification result is output through a dense layer. The output of the dense layer here is the number of traffic analogies in the dataset, corresponding to the eight categories in this dataset. At this point, the classification model for the training set has been trained, resulting in a trained classification model.

[0143] Step 6: The test set in step 2 is used to extract features through the EResGAT model. The dataset is then used to construct the adjacency matrix in step 4 as a new test set, which is then input into the trained classification model to evaluate the performance of the classification model. Specifically:

[0144] The dataset after feature extraction by the EResGAT model in step 2 is used as a new test set through the adjacency matrix construction method in step 4, and then input into the classification model GCN trained in step 5 for classification test. The classification model is evaluated by using confusion matrix diagram, accuracy, recall rate, and F1-score.

[0145] Example 2

[0146] Based on Example 1, the Dropout layer randomly discards some neurons during the training process to reduce the risk of overfitting. The discard ratio is set to 0.5, and the Dropout layer is closed after the model training is completed to ensure the accuracy of the model in testing or actual application.

[0147] Example 3

[0148] Based on Example 2, in step 2.2, 80% of the samples in the data set are used as a training set, and 20% of the samples in the data set are used as a test set.

[0149] Example 4

[0150] Based on Example 3, this example selects the public data set CICIoT 2023, and selects eight types of network traffic with relatively balanced data volume. The total number of traffic is 148,071, including 21,030 normal network traffic, 10,913 DDoS attack traffic targeting the ACK field, 23,706 ICMP flood attack traffic, 39,153 SYN flood attack traffic, 8,960 DDoS attack traffic for slow HTTP requests, 7,935 DoS flood attack traffic for HTTP, 25,790 DoS flood attack traffic for UDP, and 10,584 network vulnerability scanning abnormal traffic.

[0151] The method of the present invention is used to train the GCN using the processed adjacency matrix corresponding to 80% of all the data. Then the adjacency matrix corresponding to the remaining 20% ​​of the processed data is constructed and tested. The test results are as follows:

[0152] Table 1 Model evaluation indicators

[0153] Accuracy Recall F1 score Sample size Normal network traffic 0.9832 0.9832 0.9858 8412 ACK DDoS attack traffic 0.9915 0.9867 0.9891 4366 ICMP flood attack traffic 0.9973 0.9985 0.9979 9482 SYN flood attack traffic 0.9905 0.9937 0.9921 15662 Slow down the flow of HTTP requests 0.9634 0.9282 0.9445 3584 HTTP DoS attack traffic 0.9615 0.9282 0.9445 3174 UDP DoS attack traffic 0.9965 0.9961 0.9963 10316 Network vulnerability scanning abnormal traffic 0.9651 0.9665 0.9658 4234

[0154] The network traffic classification results of the eight types of data as shown in Table 1 are evaluated as follows. From the results in Table 1, it can be seen that the classification accuracy, recall rate, F1 score, etc. of the method of the present invention are close to 1. Figure 2 As shown in the figure, it is the confusion matrix corresponding to the classification result of the model in this embodiment. Figure 2 It can be seen that the model has high accuracy, which proves that the present invention is effective in intrusion detection.

Claims

1. A network intrusion detection method based on graph attention mechanism combined with GCN is characterized by: Please follow the steps below to implement it: Step 1: Preprocess the original CSV format network traffic data and encode the traffic labels; Step 2: Combine and filter the preprocessed data to form a new feature, then combine the feature with the remaining features to obtain a new dataset, and divide the dataset into a training set and a test set; The step 2 is specifically implemented according to the following steps: Step 2.1: Combine and filter the features containing IP addresses or ports in the data processed in step 1 to form new features, namely, Srate and Drate. The Srate and Drate features are integers containing the IP addresses and ports in the original pcap data packets obtained by the feature extraction tool of the public dataset CICIoT 2023. Add the Srate and Drate features and assign them to the packet transmission rate Srate of the source IP as a new feature. Then, the packet header length Header_Length is used as another filtered feature. These two features are combined with the remaining features to form new traffic data. Step 2.2: Use the new traffic data processed in step 2.1 as a data set sample, and divide the data set sample into a training set and a test set; Step 2.3: Use the from_pandas_edgelist method in the networkx library to construct an undirected graph for all the traffic data in the training set and the test set, and then create a graph G from the constructed undirected graph using the from_networkx method in the DGL library. The graph G1 obtained from all the traffic data in the training set is the training graph, and the graph G2 obtained from all the traffic data in the test set is the test graph. The training graph and test graph here correspond to the subsequent training set and test set to meet the subsequent model input requirements; Step 2.4: Expand the training graph G1 and the test graph G2 created in step 2.3 to obtain expanded training graphs and test graphs. Step 3: Build the network traffic feature extraction model EResGAT, input the converted training set, and extract the features between the context flows corresponding to each flow as the new training set; The step 3 is specifically as follows: Step 3.1: The training graph and test graph obtained in step 2 are called bipartite graphs. The edges directly connecting any two nodes in the bipartite graph are used as nodes in the line graph. If the source and destination nodes of two edges in the bipartite graph have a common node, the nodes corresponding to the two edges in the line graph are connected to form a new graph structure, namely the line graph. The corresponding line graphs of the training graph and the test graph are obtained respectively, which serve as the training set and test set for subsequent model input. Step 3.2: Construct a feature extraction model. EResGAT introduces a residual structure based on GAT. The input of the EResGAT model is the training set and test set constructed in step 3.

1. For each node v in the graph, the weighted average of the adjacent features is first calculated, and then the weighted average of the adjacent features is added to the converted node features. The converted node features correspond to the edge edge_attr attributes of the v node in the graph G constructed in step 2. At the kth layer of the node aggregation feature, the attention-based aggregation feature with residual As shown in Formula 1: in, represents the aggregated features of node u at the k-1th layer, is the value range of node v’s neighbor node u, is assigned to the edge in the line graph The attention coefficient, is the activation function, Indicates serial splicing, is the feature of node v, is the cross-layer weight matrix, is the weight matrix of the layer where node v is located, mapping the input features to a lower dimension, and the attention coefficient It can be simply done through a feedforward neural network Come learn, is a weight vector, and then the attention coefficients of all node pairs are obtained through LeakyRELU activation and softmax function, as shown in Formula 2: Multi-head attention is used to increase the capacity of the EResGAT model. The multi-head EResGAT aggregation expression is shown in Formula 3: Among them, there are M attention heads, is the mth attention coefficient, Corresponding to the mth weight matrix, the original node features are and The results of the multiplication are concatenated; Step 3.3: After extracting the features between the contextual traffic of the network traffic corresponding to the linear graph in step 3.2, take the training set and test set constructed in step 3.1 as input to generate a new dataset, including the training set Train and the test set Test; Step 4: Build the network traffic classification model GCN; Step 5: Train the network traffic classification model GCN to obtain a trained classification model; Step 6: Evaluate the performance of the classification model.

2. The network intrusion detection method based on graph attention mechanism combined with GCN according to claim 1 is characterized in that: The step 1 is specifically implemented according to the following steps: Replace all inf and nan values ​​in the original data features with 0; map all IP addresses in the original data features to randomly assigned IP addresses; encode the label features in the original traffic using label encoding, and use the encoding results to refer to the specific traffic type.

3. The network intrusion detection method based on graph attention mechanism combined with GCN according to claim 2 is characterized in that: In step 2.3, all traffic data in the training set and test set are respectively constructed into an undirected graph through the from_pandas_edgelist method in the networkx library. The specific process is as follows: The df attribute is the tabular data converted from the 47 columns of traffic data in the training or test set, including Srate and Header_Length obtained by combined screening. The df attribute represents the data to be converted into a graph. The format is DataFrame. The tabular data has 47 columns of features and the number of rows is the number of traffic data items in the training or test set. One data item corresponds to one row. The source attribute is Header_Length in the table data. The source attribute is the valid column name of the source node in the constructed undirected graph in df; The target attribute is the Srate in the table data. The target attribute is the valid column name of the target node in the constructed undirected graph in df; The edge_attr attribute is the 44 column features and Label feature in df excluding Header_Length, Srate, and Label features. The edge_attr attribute is the feature of the edge corresponding to the source node and the target node in the constructed undirected graph, that is, the edge feature; The create_using attribute is MultiGraph(); By setting the corresponding properties, you can get an undirected graph.

4. The network intrusion detection method based on graph attention mechanism combined with GCN according to claim 3 is characterized in that The graph G created in step 2.3 includes the number of nodes num_nodes, the number of edges num_edges, the format of all attributes of the nodes ndata_schemes, the format of all attributes of the edges edata_schemes, the object ndata containing all nodes, and the object edata containing all edges.

5. The network intrusion detection method based on graph attention mechanism combined with GCN according to claim 4 is characterized in that: The step 2.4 is specifically as follows: Add an attribute h2 to ndata. h2 is a numeric matrix with all values ​​3. The number of rows in the numeric matrix is ​​num_nodes, and the number of columns is the same as the number of features in df excluding Header_Length, Srate, and Label. Attribute h2 corresponds to the features of all nodes in graph G. edata is obtained from the edge_attr attribute when creating a graph based on the networkx and DGL libraries. Specifically, the attributes h1 and L of edata are generated according to the content of the edge_attr attribute, where h1 represents the features of all edges in the graph, corresponding to the features in df in the edge_attr attribute except for Header_Length, Srate, and Label features. The L attribute represents all edges in the graph, that is, the labels corresponding to all flows, corresponding to the Label feature in the edge_attr attribute; edata_schemes has generated attributes S1 and label when creating a graph based on the networkx and DGL libraries. S1 represents the shape of the feature stored in any single edge in the graph, and label represents the format of the label corresponding to each edge. ndata_schemes is initially empty. After adding the attribute h2 to ndata as mentioned above, a new attribute S2 is generated in ndata_schemes. Attribute S2 represents the shape of the feature stored in any single node in the graph. At this point, the graph G has been expanded. The number of edges in the graph corresponds to the total number of flows in the initial dataset. The number of nodes corresponds to the number of unique Header_Length and Srate tuples in all flows.

6. The network intrusion detection method based on graph attention mechanism combined with GCN according to claim 5 is characterized in that The step 4 is specifically as follows: Construct a GCN network traffic classification model. Use the dataset corresponding to the features extracted in step 3 to convert it into an adjacency matrix structure. The rows and columns of the matrix correspond to the unique values ​​of the Srate and Header_Length features in step 2.

1. If the corresponding values ​​of Srate and Header_Length exist in a piece of network traffic, the matrix position value of the corresponding row and column in the matrix is ​​set to 1. Then, a multi-layer GCN model is constructed to identify and classify various attack traffic in the network traffic. The multi-layer GCN is expressed as follows: in, For GCN The activation matrix of the layer, For the The trainable weight matrix of the layer, is the activation function, and the number of hidden layer units in the CGN is marked as , , is the constructed neighbor matrix, for The GCN model consists of 1 input layer, L=4 hidden layers, 4 Dropout layers and 1 Dense layer.

7. The network intrusion detection method based on graph attention mechanism combined with GCN according to claim 6 is characterized in that The step 5 is specifically as follows: The adjacency matrix corresponding to the training set Train in the new data set constructed in step 3.3 is input into the network traffic classification model GCN constructed in step 4 for training. First, it passes through the input layer, and the input data format meets the format requirements of the input layer. Then it loops through 4 hidden layers and the Dropout layer, and finally outputs the classification result through the Dense layer. At this point, the classification model corresponding to the training set has been trained and a trained classification model is obtained.

8. The network intrusion detection method based on graph attention mechanism combined with GCN according to claim 7 is characterized in that: The step 6 is specifically as follows: The new test set Test after extracting features from the test set in step 2 through the model EResGAT is input into the GCN model trained in step 5 to perform classification test after the adjacency matrix obtained by the adjacency matrix construction method in step 4 is input.

Images