A Malicious Traffic Detection Method in Graph Networks Based on Adjacency Matrix Reconstruction Jump Loss

Abstract

The present invention relates to a method for detecting malicious traffic in a graph network based on adjacency matrix reconstruction jump loss, comprising: obtaining source data of a web page node to be tested; inputting the source data of the web page node to be tested into a node category classification model based on a reconstructed jump loss function to obtain a predicted category of traffic of the web page node to be tested; comparing the predicted category of traffic of the web page node to be tested with the actual category, and if the difference between the predicted category of traffic of the web page node to be tested and the actual category is greater than a preset threshold, it is determined that the website is visited by malicious traffic, and the web page node determined to be visited by malicious traffic is output. The present invention stores and predicts web page data in the form of graph data, and constructs a reconstructed jump loss function to train a web page node classification model for traffic prediction by reconstructing the adjacency matrix and using the similarity comparison of positive and negative sample node pairs at different stages, and more accurately identifies web pages visited by malicious traffic by comparing the predicted traffic with the actual traffic.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a graph network malicious traffic detection method based on adjacency matrix reconstruction jump loss. Background Art

[0002] In the field of network security, malicious traffic detection methods are designed to identify and block malicious access behaviors in the network, thereby protecting computer networks and their resources from illegal attacks.

[0003] Traditional malicious traffic detection methods mainly include: signature-based detection and anomaly-based detection. Signature-based detection relies on a signature database of known attack patterns, and identifies malicious traffic by matching traffic features with features in the signature database. AAShafi uses genetic algorithms to update the signature patterns of malicious traffic, but cannot detect new attacks; Snort proposed by M.Roesch is an open source intrusion detection system that identifies threats through predefined rules, but requires frequent updates of the signature database to deal with new malicious traffic; Suricata developed by RDMurdoch et al. is also a signature-based detection tool that can efficiently analyze network traffic, but also relies on a signature database, and has limited detection capabilities for unknown attacks and variant attacks.

[0004] Anomaly-based detection identifies potential malicious activities by establishing a baseline for normal traffic behavior and detecting abnormal behaviors that deviate from the baseline. DE Denning et al. use a rule-based approach that uses pattern matching and anomaly detection techniques to detect unknown attacks, but it is prone to high false alarm rates, and the predefined nature of the rules makes it difficult to adapt to complex attack patterns; the statistical anomaly detection method proposed by LW McLaughlin et al. identifies abnormal behavior by analyzing the statistical characteristics of traffic, but may misreport natural fluctuations in normal traffic and has a high computational overhead when processing large-scale data; the distance-based anomaly detection method proposed by JM Patel et al. identifies anomalies by calculating the distance of traffic data, but this method may be sensitive to the choice of distance metric, which may lead to poor detection results, especially in the case of high data dimensions.

[0005] Malicious traffic detection also uses a variety of machine learning methods. For example, P. Garcia-Teodoro et al. proposed an anomaly detection method based on support vector machines. They detected abnormal traffic by establishing a baseline model, but the processing efficiency of high-dimensional and large-scale data was low, and the performance depended on parameters and data quality. Dr. Saurabh Mukherjee et al. discussed the use of naive Bayes classifiers for intrusion detection. They used labeled data to analyze the characteristics of network traffic to identify potential intrusion activities. However, they assumed that the features were independent of each other and might not be able to capture the complex relationship between the features, affecting the accuracy of detection.

[0006] Deep learning methods have shown beneficial effects in malicious traffic detection. For example, Z.Xu et al. used the spatial hierarchy of convolutional neural networks for classification, but performed poorly when processing dynamic features. Y.Kim et al. used recursive neural networks to process time series data, but may face the problem of gradient vanishing, which affects the stability of the model. The deep autoencoder proposed by L.Zhang et al. detects abnormal traffic by reconstructing errors, but it relies heavily on the quality of training samples and the training process is complicated.

[0007] Graph convolutional networks have significant advantages in malicious traffic detection. They can naturally capture and process graph structure information in network traffic and accurately describe and analyze complex relationships between nodes. For example, A. Lee et al. effectively distinguish normal traffic from malicious traffic through graph structure features; B. Wang et al. proposed a graph convolutional network model that performs well in detecting network attacks, especially with strong generalization capabilities when dealing with complex traffic patterns; C. Zhang et al. used graph convolutional networks for anomaly detection and successfully identified attacks that had never been seen before by learning structural patterns in the network. Graph convolutional networks provide a more accurate and robust malicious traffic detection solution by utilizing graph structure characteristics. Summary of the invention

[0008] The purpose of the present invention is to provide a graph network malicious traffic detection method based on adjacency matrix reconstruction jump loss to solve the problems existing in the above-mentioned prior art. Web page data is stored and predicted in the form of graph data. By reconstructing the adjacency matrix and using the similarity comparison of positive and negative sample node pairs at different stages, a reconstructed jump loss function is constructed to train a web page node classification model for traffic prediction. By comparing the predicted traffic with the actual traffic, web pages accessed by malicious traffic can be more accurately identified.

[0009] To achieve the above object, the present invention provides the following solutions:

[0010] A method for detecting malicious traffic in a graph network based on adjacency matrix reconstruction jump loss, comprising:

[0011] Get the source data of the web page node to be tested;

[0012] Input the web page node source data to be tested into a preset web page node traffic prediction model to obtain the predicted category of the web page node traffic to be tested; wherein, the web page node traffic prediction model is constructed by a node category classifier based on a reconstructed jump loss function, and the reconstructed jump loss function uses a cross entropy loss function to guide the node category classifier to complete node classification, and uses a jump loss function to maintain the consistency of node features. By selecting positive and negative samples, the node category classifier's ability to distinguish different nodes is improved, so that it can distinguish between similar and dissimilar nodes, thereby improving the training effect. The node category classifier is obtained by training using a pre-constructed data set, and the data set includes: web page node graph network data converted based on web page node source data and normal traffic labels of web page nodes;

[0013] Compare the predicted traffic category of the web page node to be tested with the actual category, where the actual category is obtained by labeling the actual traffic data of the web page node to be tested provided by a third-party traffic monitoring service. If the difference between the predicted traffic category of the web page node to be tested and the actual category is greater than a preset threshold, it is determined that the website is accessed by malicious traffic, and the web page node determined to be accessed by malicious traffic is output.

[0014] Optionally, pre-building the data set includes:

[0015] Obtain web page node source data, build a web page node graph network based on the web page node source data as feature data required for model training, and annotate normal traffic data of web page nodes with normal traffic labels as label data required for model training;

[0016] The webpage node graph network is:

[0017] G={X∈R N*D , A∈R N*N}

[0018] Among them, X represents the initial features of web page nodes, A represents the adjacency matrix of web page nodes, N represents the number of nodes, D represents the number of feature channels of the initial features of web page nodes, G represents the web page node graph network, and R N*D represents the set of real matrices with N rows and D columns, R N*N Represents the set of real matrices with N rows and N columns.

[0019] Optionally, the node category classifier is:

[0020] X layer1 =W 1 X

[0021] X layer2 =ReLU(W 1 X)

[0022] X layer3 = dropout(ReLU(W 1 X))

[0023] X layer4 =W 2 X layer3

[0024] X predict =softmax(W 2 X layer3 )

[0025] Among them, X layer1 represents the fully connected layer, W 1 represents the learnable weight matrix, X represents the input of the node category classifier, X layer2 represents the activation function layer, ReLU represents the activation function, X layer3 represents the dropout layer, dropout represents the dropout function, X layer4 represents the fully connected layer, W 2 represents the learnable weight matrix, X predict represents the category probability matrix, and softmax represents the activation function.

[0026] Optionally, obtaining the reconstruction jump loss function includes:

[0027] Based on the output of the node category classifier, construct a category consistency adjacency matrix;

[0028] Based on the initial features of the web page nodes, the KNN algorithm is used to find the k nodes that are most similar to each node feature and construct the KNN adjacency matrix;

[0029] Based on the category consistency adjacency matrix and the KNN adjacency matrix, construct a reorganized node graph network adjacency matrix;

[0030] Based on the reorganized node graph network adjacency matrix and the original web page node graph network, constructing a node pair set of positive and negative sample nodes;

[0031] Calculating an initial jump loss function based on the positive and negative sample node pairs in the node pair set;

[0032] The initial jump loss function and the cross entropy loss function are weighted and aggregated with the hyperparameter λ to obtain the final reconstructed jump loss function.

[0033] Optionally, constructing a category consistency adjacency matrix includes:

[0034] Calculating the category consistency adjacency matrix includes:

[0035] Performing a transposed matrix multiplication process on the output of the node category classifier, calculating the category consistency score between each node, and obtaining a category consistency measurement matrix S;

[0036] The adjacency matrix A of the web page node is dot-multiplied with the category consistency measurement matrix S, a threshold α is set, and the dot-multiplication result is processed by a soft threshold function to obtain the category consistency adjacency matrix between the nodes of the link edge.

[0037] Optionally, constructing the KNN adjacency matrix includes:

[0038] Based on the initial feature X of the web page node, the k nearest neighbor nodes most similar to each node are calculated, and the found k nodes are used as the neighborhood of the current node to construct the KNN adjacency matrix.

[0039] Optionally, constructing a reorganized node graph network adjacency matrix includes:

[0040] The category consistency adjacency matrix and the KNN adjacency matrix are normalized using their respective degree matrices, and then the two adjacency matrices are weightedly aggregated using a hyperparameter θ. Finally, self-loops are added to obtain the reorganized node graph network adjacency matrix that includes both local and global neighborhoods.

[0041] Optionally, the node pair set for constructing positive and negative sample nodes includes:

[0042] Taking the two nodes connected by each edge in the reorganized node graph network adjacency matrix as positive sample node pairs;

[0043] Based on the original web page node graph network, the m nodes that are most dissimilar to each node are calculated by cosine similarity as negative sample node pairs;

[0044] The node pair set is obtained by taking a union of the positive sample node pair set and the negative sample node pair set.

[0045] Optionally, calculating the initial jump loss function includes:

[0046] Calculate the feature similarity of the positive and negative sample node pairs in the node pair set after passing through the last message propagation layer;

[0047] Based on the feature similarity, constructing the initial jump loss function;

[0048]

[0049] Among them, L jump is the initial jump loss function, |τ + | represents the number of positive sample node pairs, m is the number of negative sample node pairs, B ijrepresents the feature similarity of the node pair after the message propagation layer, Q ij represents the feature similarity of the node pair before message propagation, W 4 is the learnable weight matrix, is the webpage node feature of node i after the last layer l of message propagation, is the web node feature of node j after l layers of message propagation, v i is the i node in the webpage node graph network, v j is the j node in the web page node graph network, and τ is the set of all positive and negative node pairs.

[0050] Optionally, the reconstruction jump loss function is:

[0051] L=L class +λL jump

[0052] Among them, L is the reconstruction jump loss function, L class is the cross entropy loss function and λ is a hyperparameter.

[0053] The beneficial effects of the present invention are:

[0054] The present invention provides a method for detecting malicious traffic in a graph network based on adjacency matrix reconstruction jump loss. The web page data is stored and predicted in the form of graph data, and the reconstructed jump loss function is constructed to train the web page node classification model for traffic prediction by reconstructing the adjacency matrix and using the similarity comparison of positive and negative sample node pairs at different stages. By comparing the predicted traffic with the actual traffic, the web pages accessed by malicious traffic can be more accurately identified. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0056] Figure 1 A schematic flow chart of a method for detecting malicious traffic in a graph network based on adjacency matrix reconstruction jump loss according to an embodiment of the present invention;

[0057] Figure 2 is a network structure diagram of an embodiment of the present invention;

[0058] Figure 3 Schematic diagram of the structure of a node category classifier module according to an embodiment of the present invention. DETAILED DESCRIPTION

[0059] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0060] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0061] like Figure 1 As shown, this embodiment provides a graph network malicious traffic detection method based on adjacency matrix reconstruction jump loss, including:

[0062] Get the source data of the web page node to be tested;

[0063] Input the source data of the web page node to be tested into the preset web page node traffic prediction model to obtain the predicted category of the web page node traffic to be tested; wherein, the web page node traffic prediction model is constructed by a node category classifier based on a reconstructed jump loss function, the reconstructed jump loss function uses a cross entropy loss function to guide the node category classifier to complete node classification, and uses the jump loss function to maintain the consistency of node features, and through the selection of positive and negative samples, improves the node category classifier's ability to distinguish different nodes, so that it can distinguish similar and dissimilar nodes, and improves the training effect; the node category classifier is obtained by training using a pre-constructed data set, and the data set includes: web page node graph network data converted based on web page node source data and normal traffic labels of web page nodes;

[0064] Compare the predicted traffic category of the web page node to be tested with the actual category. The actual category is obtained by labeling the actual traffic data of the web page node to be tested provided by a third-party traffic monitoring service. If the difference between the predicted traffic category and the actual category of the web page node to be tested is greater than the preset threshold, it is determined that the website is visited by malicious traffic, and the web page nodes determined to be visited by malicious traffic are output.

[0065] Specifically, in this embodiment, when implementing a method for detecting malicious traffic in a graph network based on reconstructing jump loss with an adjacency matrix, first obtain a web page data set and construct a web page node graph network; construct a node category consistency adjacency matrix and a KNN adjacency matrix in the graph, reorganize the adjacency matrix of the node graph network and use it to select positive and negative sample pairs of nodes, and reconstruct the jump loss function based on the feature similarity measurement of the positive and negative sample pairs at the message propagation layer; train a web page node classification model based on the reconstructed jump loss function in combination with a web page source data set and a web page normal traffic data set to obtain a trained web page node classification model; input the source data of the web page node to be tested into the trained model, predict its traffic classification result, and compare it with the actual traffic data, and finally output the web page that is determined to be accessed by malicious traffic. This embodiment proposes a method for detecting malicious traffic by combining a graph network to achieve accurate detection of malicious traffic in web page access.

[0066] Furthermore, the pre-built datasets include:

[0067] Obtain web page node source data, and build a web page node graph network corresponding to the web page node source data based on the hyperlink relationship between web pages as the feature data required for model training. Annotate the normal traffic data of web page nodes with normal traffic labels as the label data required for model training.

[0068] Specifically, in this embodiment, the data set is divided and a graph network is constructed. Squirrel is used as the data set, with a total of 5201 nodes, 198493 edges, and a node feature dimension of 2089. The nodes are divided into five categories based on the average monthly traffic. The data set is divided into a training set of 2496 nodes, a validation set of 1664 nodes, and a test set of 1041 nodes by random partitioning.

[0069] The web page node graph network is G = {X∈R N*D , A∈R N*N}, X represents the initial features of web page nodes, A represents the adjacency matrix of web page nodes, and the elements in A are composed of 0 and 1. Based on the web page node graph network, the value of the i-th row and j-th column of A corresponding to two nodes i and j connected by an edge is 1, and the value of A corresponding to two nodes without an edge is 0. The set of edges formed by hyperlinks is represented as ε, N represents the number of nodes, and D represents the number of feature channels of the initial features of web page nodes.

[0070]

[0071] In this embodiment, a node category classifier is constructed. The input of the node category classifier is X. The node category classifier consists of two fully connected layers, one dropout layer, and two activation function layers. The model structure is as follows: Figure 3 shown.

[0072] The first layer is a fully connected layer, with the input being the original feature channel number D, and the learnable weight matrix W 1 After transformation, the number of output feature channels is D 1 ;

[0073] X layer1 =W 1 X.

[0074] The second layer is the ReLU activation function layer, and the number of input feature channels is D 1 , after the ReLU activation function, the number of output feature channels is D 1 .

[0075] X layer2 =ReLU(W 1 X).

[0076] The third layer is the discard layer (the discard rate is p), and the number of input feature channels is D 1 , after the discard operation, the number of feature channels output is D 1 .

[0077] X layer3 = dropout(ReLU(W 1 X)).

[0078] The fourth layer is a fully connected layer, and the number of input feature channels is D 1 , through the learnable weight matrix W 2 After the transformation, the number of output feature channels is C, where C is the number of categories of the classification task.

[0079] X layer4 =W 2 X layer3 .

[0080] The last layer is the softmax activation function layer. The number of input feature channels is C. After the softmax activation function, the category probability matrix of the web page nodes belonging to each category is obtained:

[0081] X predict =softmax(W 2 X layer3 ).

[0082] X predict =[x 1 ,x 2 ,……,x n ] T ∈R N*C .

[0083] Each row of the class probability matrix represents:

[0084] xi =[P i1 ,P i2 ,……,P ic ].

[0085] Among them, P i1 represents the probability that node i belongs to the first category, x i Represents the category probability vector composed of the probability that the i node belongs to each category, and C represents the number of categories.

[0086] Furthermore, obtaining the reconstruction jump loss function includes:

[0087] Based on the output of the node category classifier, a category consistency adjacency matrix is ​​constructed;

[0088] Based on the initial features of the web page nodes, the KNN algorithm is used to find the k nodes that are most similar to each node feature and construct the KNN adjacency matrix;

[0089] Based on the category consistency adjacency matrix and KNN adjacency matrix, the reorganized node graph network adjacency matrix is ​​constructed;

[0090] Based on the reorganized node graph network adjacency matrix and the original web page node graph network, a node pair set of positive and negative sample nodes is constructed;

[0091] Calculate the initial jump loss function based on the positive and negative sample node pairs in the node pair set;

[0092] The initial jump loss function and the cross entropy loss function are weighted and aggregated with the hyperparameter λ to obtain the final reconstruction jump loss function.

[0093] Specifically, in this embodiment, a reorganized adjacency matrix is ​​constructed, which is composed of a category consistency adjacency matrix and a KNN adjacency matrix, and the reorganized adjacency matrix is ​​multiplied with the initial feature X of the web page node to transfer information. Figure 2 As shown:

[0094] Construct a category consistency adjacency matrix:

[0095] Based on the output of the node category classifier: category probability matrix X predict , through the category probability matrix X predict Multiply it with its transposed matrix, calculate the category consistency score between each node, and get the category consistency measurement matrix S of size C*C (C is the number of traffic categories):

[0096]

[0097] The dot product of the web page node adjacency matrix A and S is taken, a threshold α is set, and the dot product result is processed by the soft threshold function to obtain the category consistency adjacency matrix A between the nodes of the link edges .

[0098] A S =soft threshold (A·S′),

[0099]

[0100] Among them, soft threshold () is the soft threshold function, · is the dot multiplication operation, and sign() is the sign function.

[0101] Construct the KNN adjacency matrix:

[0102] Based on the initial features X of the web page nodes, calculate the k nearest neighbor nodes that are most similar to each node, and use the found k nodes as the neighborhood of the current node to construct the KNN adjacency matrix A k ∈R N*k .

[0103]

[0104] in, represents the initial features of web page node i, represents the initial features of web page node j, represents the t-th dimension feature value of the initial feature of web page node i, represents the t-th dimension eigenvalue of the initial feature of web page node j, D represents the number of feature channels of the initial feature of the web page node, Q represents the similarity measurement matrix of the initial features between each web page node, It represents the set obtained by sorting the i-th row of the Q matrix in descending order. The node set consisting of the first k nodes most similar to the i-th node is recorded as Represents the KNN adjacency matrix A k The value of row i and column j.

[0105] Construct a reorganized adjacency matrix and use the reorganized adjacency matrix for information transfer:

[0106] The above two adjacency matrices A s , A k The two adjacency matrices are normalized using their respective degree matrices, and then weighted aggregated using the hyperparameter θ. Finally, self-loops are added to obtain a reorganized adjacency matrix that includes both local and global neighborhoods. The reorganized adjacency matrix is ​​used for information transfer.

[0107] Message propagation matrix:

[0108]

[0109] Message spread: X l =P*Xl-1 .

[0110] Among them, A s represents the category consistency adjacency matrix, D s Indicates A s The degree matrix, A k represents the KNN adjacency matrix, D k Indicates A k The degree matrix of X is represented by θ, which is the aggregation hyperparameter of the two adjacency matrices. l-1 represents the network node characteristics output by the l-1th message propagation layer. Similarly, X l Represents the network node characteristics output by the lth layer message propagation layer, the initial state is: X 0 =X.

[0111] The process of selecting node positive and negative sample pairs based on the adjacency matrix of the reorganized node graph network is as follows:

[0112] The two nodes connected by each edge in the reorganized node graph adjacency matrix are taken as positive sample node pairs.

[0113] τ + ={(v i ,v j )|P i,j ≠0, i≠j},

[0114]

[0115] Among them, P i,i is the element in the i-th row and j-th column of the reorganized adjacency matrix, I is the indicator function, τ + represents the set of positive sample node pairs, |τ + | represents the number of positive sample node pairs, and n is the number of web page nodes.

[0116] Based on the original web page node graph network, the m nodes that are most dissimilar to each node are calculated by cosine similarity as negative sample node pairs;

[0117]

[0118] M i = {v j1 ,v j2 ,……,v jm},

[0119] τ - ={(v i ,v j )|v i ∈N,v j ∈M i}.

[0120] in, represents the initial features of web page node i, represents the initial features of web page node j, represents the t-dimensional feature value of the initial feature of web page node i, represents the t-dimensional feature value of the initial feature of web page node j, D represents the number of feature channels of the initial feature of the web page node, Q represents the cosine similarity measurement matrix of the initial features between web page nodes, It means that the i-th row of the Q matrix is ​​sorted in ascending order, and the node set consisting of the first m nodes that are most dissimilar to the i-th node is recorded as M i , τ - Represents the set of negative sample node pairs.

[0121] The node pair set τ is obtained by taking the union of the positive sample node pairs and the negative sample node pairs, and used to calculate the initial jump loss function.

[0122] τ=τ + ∪τ - .

[0123] Specifically, in this embodiment, an initial jump loss function is calculated based on the feature similarity measurement of positive and negative sample nodes in the message propagation layer, and based on the initial jump loss function and the cross entropy loss function, the two are weightedly aggregated with a hyperparameter λ to obtain the final reconstructed jump loss function.

[0124] The process of calculating the initial jump loss function is as follows:

[0125] Calculate the feature similarity of the positive and negative sample node pairs after passing through the last message propagation layer:

[0126]

[0127] in, is the webpage node feature of node i after the last layer l of message propagation, is the web node feature of node j after l layers of message propagation, and the difference between the two is calculated through the learnable weight matrix W 4 Transformation is performed to obtain the feature similarity of the node pair after message propagation.

[0128] In order to achieve consistent feature similarity of each node pair before and after message propagation, and improve the model's ability to distinguish different nodes in the feature space and the training effect, an initial jump loss function is constructed:

[0129]

[0130] Among them, |τ + | represents the number of positive sample node pairs, m is the number of negative sample node pairs, τ represents the set of all node pairs, Bij represents the feature similarity of the node pair after the message propagation layer, Q ij Represents the feature similarity of a node pair before message propagation.

[0131] Cross entropy loss function:

[0132] L class =-∑ i y i logp(i),

[0133]

[0134] Among them, y i represents the value of the true category of node i, and p(i) represents the probability that the node classifier predicts that node i belongs to the true label of node i.

[0135] Based on the initial jump loss function and the cross entropy loss function, the two are weighted and aggregated with the hyperparameter λ to obtain the final reconstruction jump loss function. The initial jump loss function is used to maintain the consistency of node features, and the cross entropy loss function is used to guide the node category classifier to complete the node classification task. The model adopts an end-to-end training method, and uses the final reconstruction jump loss function to guide the training of the web page node classification model.

[0136] Reconstruct the jump loss function:

[0137] L=L class +λL jump .

[0138] Positive sample node pairs are selected through the reorganized node graph network adjacency matrix to ensure that the model learns the close relationship between similar nodes in the feature space. The KNN algorithm is used to find the m nodes that are most dissimilar to each node in the original node graph network as negative sample node pairs, which improves the model's ability to distinguish different nodes in the feature space. The dissimilar features between negative sample node pairs in the original node graph network can be identified and retained. The combination of positive and negative samples can improve the model's discrimination ability, so that the model can not only identify similar nodes, but also effectively distinguish dissimilar nodes, thereby improving the training effect.

[0139] Specifically, in this embodiment, the node features of the web page to be tested are input into the trained web page node classification model, the traffic prediction classification of the web page to be tested is performed, and the traffic prediction category of the web page node to be tested is compared with the actual category. If the difference between the traffic prediction category and the actual category of the web page node to be tested is greater than a preset threshold, it is determined that the website is visited by malicious traffic, and the web page node determined to be visited by malicious traffic is output.

[0140] The graph node classification model of this embodiment uses the average classification accuracy as a measure to judge the performance of the graph node classification model.

[0141] This embodiment proposes a graph network malicious traffic detection method based on adjacency matrix reconstruction jump loss. The method converts web page data into graph data, reduces the neighborhood noise in the original web page node graph network by reorganizing the adjacency matrix, and uses reconstruction jump loss to improve the discrimination ability of the model, thereby achieving accurate prediction of web page node traffic classification and improving the detection accuracy of malicious traffic.

[0142] The above embodiments are only descriptions of the preferred embodiments of the present invention, and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary technicians in this field should fall within the protection scope determined by the claims of the present invention.

Claims

1. A method for detecting malicious traffic in graph networks based on adjacency matrix reconstruction jump loss, characterized in that: include: Get the source data of the web page node to be tested; Input the web page node source data to be tested into a preset web page node traffic prediction model to obtain the predicted category of the web page node traffic to be tested; wherein the web page node traffic prediction model is constructed by a node category classifier based on a reconstructed jump loss function and obtained by training with a preconstructed data set, the reconstructed jump loss function uses a cross entropy loss function to guide the node category classifier to complete node classification, and uses an initial jump loss function to maintain the consistency of node features, and the data set includes: web page node graph network data converted based on the web page node source data and normal traffic labels of web page nodes; Compare the predicted traffic category of the web page node to be tested with the actual category. If the difference between the predicted traffic category of the web page node to be tested and the actual category is greater than a preset threshold, it is determined that the website is accessed by malicious traffic, and the web page node determined to be accessed by malicious traffic is output; Obtaining the reconstruction jump loss function includes: Based on the output of the node category classifier, a category consistency adjacency matrix is ​​constructed; Based on the initial features of the web page nodes, the KNN algorithm is used to find the k nodes that are most similar to each node feature and construct the KNN adjacency matrix; Based on the category consistency adjacency matrix and the KNN adjacency matrix, construct a reorganized node graph network adjacency matrix; Based on the reorganized node graph network adjacency matrix and the original web page node graph network, constructing a node pair set of positive and negative sample nodes; Calculating an initial jump loss function based on the positive and negative sample node pairs in the node pair set; The initial jump loss function and the cross entropy loss function are weighted and aggregated with the hyperparameter λ to obtain the final reconstructed jump loss function.

2. The method for detecting malicious traffic in a graph network based on adjacency matrix reconstruction jump loss according to claim 1 is characterized in that: The pre-built dataset includes: Obtain web page node source data, build a web page node graph network based on the web page node source data as feature data required for model training, and annotate normal traffic data of web page nodes with normal traffic labels as label data required for model training; The webpage node graph network is: G={X∈R N*D ,A∈R N*N } Among them, X represents the initial features of web page nodes, A represents the adjacency matrix of web page nodes, N represents the number of nodes, D represents the number of feature channels of the initial features of web page nodes, G represents the web page node graph network, and R N*D represents the set of real matrices with N rows and D columns, R N*N Represents the set of real matrices with N rows and N columns.

3. The method for detecting malicious traffic in a graph network based on adjacency matrix reconstruction jump loss according to claim 1 is characterized in that: The node category classifier is: X layer1 =W1X X layer2 =ReLU(W1X) X layer3 =dropout(ReLU(W1X)) X layer4 =W2X layer3 X predict =softmax(W2X layer3 ) Among them, X layer1 represents the fully connected layer, W1 represents the learnable weight matrix, X represents the initial features of the web page node, and X layer2 represents the activation function layer, ReLU represents the activation function, X layer3 represents the dropout layer, dropout represents the dropout function, X layer4 represents the fully connected layer, W2 represents the learnable weight matrix, X predict represents the category probability matrix, and softmax represents the activation function.

4. The method for detecting malicious traffic in a graph network based on adjacency matrix reconstruction jump loss according to claim 1 is characterized in that: Constructing a category consistency adjacency matrix includes: Calculating the category consistency adjacency matrix includes: Performing a transposed matrix multiplication process on the output of the node category classifier, calculating the category consistency score between each node, and obtaining a category consistency measurement matrix S; The adjacency matrix A of the web page node is dot-multiplied with the category consistency measurement matrix S, a threshold α is set, and the dot-multiplication result is processed by a soft threshold function to obtain the category consistency adjacency matrix between the nodes of the link edge.

5. The method for detecting malicious traffic in a graph network based on adjacency matrix reconstruction jump loss according to claim 1 is characterized in that: Constructing the KNN adjacency matrix includes: Based on the initial feature X of the web page node, the k nearest neighbor nodes most similar to each node are calculated, and the found k nodes are used as the neighborhood of the current node to construct the KNN adjacency matrix.

6. The method for detecting malicious traffic in a graph network based on adjacency matrix reconstruction jump loss according to claim 1 is characterized in that: Constructing the reorganized node graph network adjacency matrix includes: The category consistency adjacency matrix and the KNN adjacency matrix are normalized using their respective degree matrices, and then the two adjacency matrices are weightedly aggregated using a hyperparameter θ. Finally, self-loops are added to obtain the reorganized node graph network adjacency matrix that includes both local and global neighborhoods.

7. The method for detecting malicious traffic in a graph network based on adjacency matrix reconstruction jump loss according to claim 1 is characterized in that: The node pair set for constructing positive and negative sample nodes includes: Taking the two nodes connected by each edge in the reorganized node graph network adjacency matrix as positive sample node pairs; Based on the original web page node graph network, the m nodes that are most dissimilar to each node are calculated by cosine similarity as negative sample node pairs; The node pair set is obtained by taking a union of the positive sample node pair set and the negative sample node pair set.

8. The method for detecting malicious traffic in a graph network based on adjacency matrix reconstruction jump loss according to claim 1 is characterized in that: Calculating the initial jump loss function includes: Calculate the feature similarity of the positive and negative sample node pairs in the node pair set after passing through the last message propagation layer; Based on the feature similarity, constructing the initial jump loss function; Among them, L jump is the initial jump loss function, |τ + | represents the number of positive sample node pairs, |τ - | is the number of negative sample node pairs, B ij represents the feature similarity of the node pair after the message propagation layer, Q ij represents the feature similarity of the node pair before message propagation, W4 is a learnable weight matrix, is the webpage node feature of node i after the last layer l of message propagation, is the web node feature of node j after l layers of message propagation, v i is the i node in the webpage node graph network, v j is the j node in the web page node graph network, and τ is the set of all positive and negative node pairs.

9. The method for detecting malicious traffic in a graph network based on adjacency matrix reconstruction jump loss according to claim 1, characterized in that: The reconstruction jump loss function is: L=L class +λL jump Among them, L is the reconstruction jump loss function, L class is the cross entropy loss function and λ is a hyperparameter.

Images