Graph convolutional neural network protocol classification method based on spectral clustering composition

Abstract

The invention discloses a graph convolutional neural network protocol classification method based on spectral clustering composition, and relates to the field of network security and machine learning, and the method comprises the following steps: screening key fields from collected network protocol data; a traditional spectral clustering composition algorithm is optimized, the screened data are clustered, and the data are processed into a graph structure form suitable for a graph neural network; a graph structure obtained by spectral clustering is used as the input of a graph convolutional neural network, an S-GCN model is proposed, modeling is carried out by adopting a randomly initialized three-layer GCN, convolution is carried out on a node three-order neighborhood, and network protocol classification is realized through node feature aggregation in the last layer. Experiments prove that the method has high accuracy in classification results, advantages and disadvantages of the graph structure in the S-GCN directly influence the classification results, and meanwhile, high efficiency of the graph structure is proved.

Description

Technical Field

[0001] The present invention relates to the technical field of computer vision and natural language processing, and specifically to a graph convolutional neural network protocol classification method based on spectral clustering composition. Background Art

[0002] With the rapid development of cloud computing technology, cloud platforms, as core infrastructure for carrying high-concurrency businesses and complex computing tasks, are increasingly becoming an important pillar of modern information construction. However, the complexity and dynamic characteristics of cloud platforms often lead to performance bottlenecks and service failures during operation. Especially in cloud environments with microservices as the core architecture, services communicate through a large number of network protocols. The complexity and dynamic changes of these protocol interactions put forward higher requirements for system fault identification and rapid response. Traditional fault detection and handling methods mostly adopt rule-driven modes to analyze and judge monitoring data based on predefined thresholds or rules. However, such methods have limited adaptability to the changing characteristics of protocol interactions. Faced with the large amount of protocol data and diverse types in cloud platforms, it is difficult to achieve efficient protocol classification and accurate processing.

[0003] In the actual operating environment of cloud platforms, protocol classification is one of the key technologies for achieving efficient resource management and fault location. The purpose of protocol classification is to accurately classify network data into corresponding protocol types based on the traffic characteristics or interaction behaviors of the protocol. Existing protocol classification methods mainly rely on feature engineering and traditional machine learning models. These methods are highly dependent on manually designed features. The performance of the model is limited by the quality and generalization ability of feature extraction, and it is difficult to effectively deal with the nonlinear characteristics of complex protocol data.

[0004] In recent years, analysis methods based on graph structured data have gradually attracted attention. Since the protocol interaction data in the cloud platform is essentially networked and associative, graph modeling can more intuitively characterize the relationship and interaction mode between protocols. However, traditional graph analysis methods have obvious shortcomings in extracting global structural features and processing large-scale data. To this end, Graph Neural Network (GNN), as an emerging deep learning technology, demonstrates excellent graph structure data processing capabilities by combining node features and graph structure information for modeling. However, when directly applying graph neural networks for protocol classification, the following technical difficulties are still faced: first, how to effectively extract features from complex protocol interaction data and construct a graph structure with significant clustering characteristics; second, how to fully utilize the global and local features of the graph by designing an efficient graph neural network model to achieve high-precision protocol classification; finally, how to maintain the efficiency of the algorithm when processing massive protocol data to meet the requirements of real-time fault handling of the cloud platform.

[0005] In response to the above problems, the present invention proposes a graph convolutional neural network protocol classification method based on spectral clustering composition. By introducing a spectral clustering algorithm to preprocess the protocol data, a graph structure model with a high degree of clustering characteristics is generated, and combined with the powerful modeling ability of the graph convolutional neural network on graph structure data, efficient classification of protocol interaction data is achieved. This method can make full use of the structural characteristics of the protocol data, significantly improve the classification efficiency while maintaining a high classification accuracy, and provide strong technical support for fault identification and handling of cloud platforms. Summary of the invention

[0006] In view of the problems existing in the above-mentioned technologies, the purpose of the present invention is to provide a graph convolutional neural network protocol classification method based on spectral clustering composition.

[0007] In order to achieve the above object, the technical solution adopted by the present invention is as follows: A graph convolutional neural network protocol classification method based on spectral clustering composition includes the following steps: Step 1: Filter key fields from the collected network protocol data and generate a data set; Step 2: Optimize the traditional spectral clustering algorithm, cluster the filtered data, and process the data into a graph structure suitable for graph neural network; Step 3: Optimize the graph structure of the spectral clustering result graph in step 2; Step 4: Use the graph structure obtained by spectral clustering as the input of the graph convolutional neural network, propose the S-GCN model, use a randomly initialized three-layer GCN for modeling, perform convolution on the third-order neighborhood of the node, and realize network protocol classification by aggregating node features in the last layer.

[0008] In step 1: In the original data set, the message contains all fields from the physical layer to the application layer. The data set needs to be processed and key fields need to be screened. Step 1-1, split the data set into traffic segments. Step 1-2: perform traffic redundancy removal on the data set. Step 1-3, select fields from the data set. Steps 1-4, unify the dataset length and labels, Steps 1-5, generate a new dataset.

[0009] In step 2: After preprocessing the data, the protocol data is converted into a matrix form, where each row is a message and each column is a different feature of the message, and the data matrix is ​​obtained. ,Depend on data matrix consisting of data, each sample has Features, using spectral clustering composition algorithm for composition, as follows: Step 2-1: Construct a similarity graph matrix based on the input data matrix , Step 2-2: Construct the Laplacian matrix based on the similarity graph matrix , Step 2-3: Perform feature decomposition before extraction The eigenvector corresponding to the smallest eigenvalue is used to construct the spectral representation matrix , Step 2-4: Use K-means clustering to divide the spectral representation and obtain the clustering results , Step 2-5: Analyze and verify the clustering results.

[0010] The spectral clustering graph construction algorithm is optimized as follows: For the original sample and , and its similarity is , through the transformation matrix The original data is projected from the original feature space to the low-dimensional feature subspace. At the same time, the samples in the low-dimensional space and The local structure between them remains unchanged, and the mathematical expression is: (1)

[0011] in, is the parameter of the Gaussian kernel. Bray-Curtis distance is used to calculate the distance. The formula is as follows: (2) in, , Respectively, vector , Each characteristic component of Use orthogonal constraints to transform the matrix Constraints are imposed, and the objective function of LPP is obtained as follows: (3) in, , represents a diagonal matrix, It is a unit array. is an orthogonal constraint used to generate uncorrelated spectral vectors, with diagonal elements equal to the similarity graph matrix The row vector sum of Right now ,Use the hypergraph to construct the Laplacian matrix, and then use the hypergraph Laplacian matrix to constrain the spectrum. Formula (3) is rewritten as: (4) in, is a hypergraph Laplacian matrix, Embedding attribute selection into the subspace learning framework, (5) in, is a row sparse matrix, non-negative It is a tuning parameter that balances subspace learning and attribute selection during the learning process.

[0012] In the subsequent clustering process, the spectral rotation clustering method is used to embed spectral rotation clustering into the spectral representation learning framework to complete one-step clustering. The objective function is as follows:

[0013] (6) in, is the tuning coefficient.

[0014] Solve the objective function formula (6), First, initialize the indicator matrix , transformation matrix and the identity matrix ,Then, an iterative loop is entered and the loop will continue until the convergence criterion defined by formula (6) is met. During this iteration, the transformation matrix The update follows these three steps: Step (1) starts an inner iteration loop that executes until the transformation matrix The update of satisfies the convergence condition specified by formula (7), Step (2) In the inner loop, firstly transform the transformation matrix according to formula (11): Update, then GPI framework to the matrix Update, and finally update the matrix according to formula (13) to update.

[0015] Step (3) These steps will be repeated until the transformation matrix The update of reaches the convergence criterion set by formula (7).

[0016] After the above inner loop is completed, according to formula (15) The matrix is ​​updated, and then according to formula (16) After completing these update steps, return to the outer iteration loop and continue to update the transformation matrix , until the convergence criterion defined by formula (6) is met, the entire iterative process continues until the transformation matrix The update of satisfies the convergence condition of the outer loop, right Update, In the right When updating, you need to fix and , then solving the objective function is equivalent to solving formula (7),

[0017] (7) Using the framework of iterative weighted least squares to solve the non-smooth problem of formula (7), formula (7) becomes the following:

[0018] (8) in is a hypergraph diagonal matrix whose diagonal elements are , The alternating direction multiplication operator framework is used to decompose the complex problem into multiple easy-to-solve sub-problems. Then formula (8) becomes the following:

[0019] (9) After the transformation of the above formula, the optimization problem is converted into three sub-problems to be solved: (10) against , , To update, Set the value to 1. The derivative of is set to 0, which gives The closed solution is: (11) and The update is achieved directly through the transformation:

[0020] (12) in , When calculated and After that, we get The optimization is performed by formula (13) Optimization: (13) right Update, In Update When you need to fix and , then the objective function becomes the following formula: (14) is an indicator matrix whose elements There are only two values ​​0 and 1. Yes The solution of formula (14) is as follows: (15) right Update, renew Need to and If is fixed, the objective function is equivalent to the following:

[0021] (16) Minimize formula (16), which is equivalent to:

[0022] (17) Re-establish and About The left and right singular matrices of the singular value decomposition of the point are: (18) The non-orthogonal clustering indicator matrix is ​​replaced by the standard orthogonal scaling clustering indicator matrix to minimize the difference between the two standard orthogonal matrices. The closed-form solution of is: (19).

[0023] Step 3: Optimize the graph structure of the spectral clustering result graph in step 2, as follows: The data set processed in step 2 , define The samples and the probability of all data points are Connect to A neighbor of Determined by the following formula: (20) Find a linear combination that is closest to the original features of the low-dimensional manifold, as follows: (twenty one) Agree on a binding letter ,in is the similarity graph matrix The number of connected components in is given by With the initial graph Fitting: (twenty two) in is the updated Laplacian matrix, the initial graph is the graph obtained from step 3, Using graph learning and Sparse learning can solve the noise and outlier problems, as shown below: (twenty three) The constraints depending on , yes No. eigenvalues, when it is semi-positive definite, we have And the constraint function express , and then by Fan Ji's theorem we get: (twenty four) Formula (23) is solved by the following formula:

[0024] (25) is a non-negative tuning parameter, represents the characteristics of the feature space after reduction. By solving formula (25), a high-quality graph is obtained. In step 4, a graph convolutional neural network model based on spectral clustering is constructed, and the graph structure data optimized in step 3 is input into the model for network protocol classification. Use hypergraphs for semi-supervised classification of nodes and define an undirected hypergraph ,in represents a vertex, Represents edges, and also a small set of labeled supernodes , each supernode is associated with a feature vector ,in is the number of dimensions, The key is the graph Laplace operator, the definition of Laplace operator is as follows, The calculation formula is as follows, 1) For each hyperedge ,make , 2) Set the weight to Edge Add to Vertex On the top, construct a weighted graph ,in For super edge The weight of Add a self-loop on the vertex The degree in is equal to ,set up express The weighted adjacency matrix of 3) The symmetric normalized hypergraph Laplace function is: (26) After obtaining the adjacency matrix and the feature matrix composed of all node features, the graph convolution operation is performed by transferring aggregate information between nodes through formula (27). A three-layer GCN with randomly initialized weights is used to capture the structure of the entire graph. The node features are aggregated in the last layer for classification, and finally a global attention mechanism is used for output.

[0025] (27) in, Added self-connected undirected graph The adjacency matrix of It is a unit array; is a layer-specific trainable weight matrix; represents the activation function; It is The activation matrix of the layer, and , Compared with the prior art, the advantages of this application are as follows: Based on traditional spectral clustering, this application optimizes the spectral clustering algorithm. Specifically, by combining subspace learning and attribute selection for dimensionality reduction, it can dynamically select inherent important attributes, construct a robust spectral representation in low-dimensional space, and avoid the influence of redundant attributes and outliers. This application uses a high-quality graph structure to optimize the classification performance of the GCN model. An adaptive graph learning is introduced to capture the intrinsic low-level correlation of the data, and a hypergraph is used to establish the relationship between the data. In view of the redundant information of the data, this application uses sparse learning and low-rank constraints with graph learning, combining the two to improve the accuracy of the results and the robustness of the model. Experimental results show that the proposed composition method based on spectral clustering and the optimized classification method S-GCN are superior to other comparative methods in protocol classification and recognition. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 Schematic diagram of protocol data preprocessing; Figure 2 Schematic diagram of the S-GCN framework; Figure 3 Schematic diagram of the comparison of clustering results of composition methods; Figure 4 2D visualization diagram of protocol classification results; Figure 5 Schematic diagram of the objective function convergence curve; Figure 6 It is a schematic diagram of the overall process of the present invention. DETAILED DESCRIPTION

[0027] Hereinafter, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily implement them. In addition, for the sake of clarity, parts not related to the description of the exemplary embodiments are omitted in the accompanying drawings.

[0028] It should also be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other. The present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0029] Example: See Figure 1-Figure 6 , a graph convolutional neural network protocol classification method based on spectral clustering composition, comprising the following steps: Step 1: Filter out key fields from all network protocols from the physical layer to the application layer in the data set to generate a new data set; Step 2: Combine subspace learning and attribute selection to optimize the traditional spectral clustering algorithm, and construct the data set processed in step 1 using the optimized spectral clustering algorithm; Step 3: Optimize the graph structure of the spectral clustering result graph in step 2; Step 4: Build a graph convolutional neural network model based on spectral clustering composition, and input the graph structure data optimized in step 3 into the model for network protocol classification.

[0030] The data comes from the Internet real-time communication data packets provided by Green Alliance Technology Co., Ltd. The original data format is pcap data packets. It includes 7 industrial protocol messages such as Modbus and Omron, and each message has 2000-4000 as the experimental data set, as shown in Table 1. In the original data set, the message contains all fields from the physical layer to the application layer. The data set needs to be processed to filter the key fields.

[0031] Table 1 Dataset information statistics

[0032] like Figure 1 As shown, In step 1, in the original data set, the message contains all fields from the physical layer to the application layer. The data set needs to be processed to filter the key fields. Step 1-1, split the data set into traffic segments. Step 1-2: perform traffic redundancy removal on the data set. Step 1-3, select fields from the data set. Steps 1-4, unify the dataset length and labels, Steps 1-5, generate a new dataset.

[0033] After preprocessing the data, the protocol data is converted into a matrix form, where each row is a message and each column is a different feature of the message, and the data matrix is ​​obtained. ,Depend on data matrix consisting of data, each sample has Features, using spectral clustering composition algorithm for composition, as follows: Step 2-1: Construct a similarity graph matrix based on the input data matrix , Step 2-2: Construct the Laplacian matrix based on the similarity graph matrix , Step 2-3: Perform feature decomposition before extraction The eigenvector corresponding to the smallest eigenvalue is used to construct the spectral representation matrix , Step 2-4: Use K-means clustering to divide the spectral representation and obtain the clustering results , Step 2-5: Analyze and verify the clustering results.

[0034] The spectral clustering graph construction algorithm is optimized as follows: For the original sample and , and its similarity is , through the transformation matrix The original data is projected from the original feature space to the low-dimensional feature subspace. At the same time, the samples in the low-dimensional space and The local structure between them remains unchanged, and the mathematical expression is: (1)

[0035] Bray-Curtis distance is used to calculate the distance, and the formula is as follows: (2) Among them, , Respectively, vector , Each characteristic component of Use orthogonal constraints to transform the matrix Constraints are imposed, and the objective function of LPP is obtained as follows: (3) in, , represents a diagonal matrix, It is a unit array. is an orthogonal constraint used to generate uncorrelated spectral vectors, with diagonal elements equal to the similarity graph matrix The row vector sum of Right now ,Use the hypergraph to construct the Laplacian matrix, and then use the hypergraph Laplacian matrix to constrain the spectrum. Formula (3) is rewritten as: (4) in, is a hypergraph Laplacian matrix, Embedding attribute selection into the subspace learning framework, (5) in, is a row sparse matrix, non-negative It is a tuning parameter that balances subspace learning and attribute selection during the learning process. In the subsequent clustering process, the spectral rotation clustering method is used to embed spectral rotation clustering into the spectral representation learning framework to complete one-step clustering. The objective function is as follows:

[0036] (6) in, is the tuning coefficient.

[0037] Solve the objective function formula (6), First, initialize the indicator matrix , transformation matrix and the identity matrix ,Then, an iterative loop is entered and the loop will continue until the convergence criterion defined by formula (6) is met. During this iteration, the transformation matrix The update follows these three steps: Step (1) starts an inner iteration loop that executes until the transformation matrix The update of satisfies the convergence condition specified by formula (7), Step (2) In the inner loop, firstly transform the transformation matrix according to formula (11): Update, then GPI framework to the matrix Update, and finally update the matrix according to formula (13) to update.

[0038] Step (3) These steps will be repeated until the transformation matrix The update of reaches the convergence criterion set by formula (7).

[0039] After the above inner loop is completed, according to formula (15) The matrix is ​​updated, and then according to formula (16) After completing these update steps, return to the outer iteration loop and continue to update the transformation matrix , until the convergence criterion defined by formula (6) is met, the entire iterative process continues until the transformation matrix The update of satisfies the convergence condition of the outer loop, right Update, In the right When updating, you need to fix and , then solving the objective function is equivalent to solving formula (7),

[0040] (7) Using the framework of iterative weighted least squares to solve the non-smooth problem of formula (7), formula (7) becomes the following:

[0041] (8) in is a hypergraph diagonal matrix whose diagonal elements are , The alternating direction multiplication operator framework is used to decompose the complex problem into multiple easy-to-solve sub-problems. Then formula (8) becomes the following:

[0042] (9) After the transformation of the above formula, the optimization problem is converted into three sub-problems to be solved: (10) Needle Needle , , To update, Set the value to 1. The derivative of is set to 0, which gives The closed solution is: (11) and The update is achieved directly through the transformation:

[0043] (12) in , When calculated and After that, we get The optimization is performed by formula (13) Optimization: (13) right Update, In Update When you need to fix and , then the objective function becomes the following formula:

[0044] (14) is an indicator matrix whose elements There are only two values ​​0 and 1. Yes The solution of formula (14) is as follows: (15) right Update, renew Need to and If is fixed, the objective function is equivalent to the following:

[0045] (16) Minimize formula (16), which is equivalent to:

[0046] (17) Re-establish and About The left and right singular matrices of the singular value decomposition of the point are: (18) The non-orthogonal clustering indicator matrix is ​​replaced by the standard orthogonal scaling clustering indicator matrix to minimize the difference between the two standard orthogonal matrices. The closed-form solution of is: (19).

[0047] Step 3: Optimize the graph structure of the spectral clustering result graph in step 2, as follows: The data set processed in step 2 , define The samples and the probability of all data points are Connect to A neighbor of Determined by the following formula: (20) Find a linear combination that is closest to the original features of the low-dimensional manifold, as follows: (twenty one) Agree on a binding letter ,in is the similarity graph matrix The number of connected components in is given by With the initial graph Fitting: (twenty two) in is the updated Laplacian matrix, the initial graph is the graph obtained from step 3, Using graph learning and Sparse learning can solve the noise and outlier problems, as shown below: (twenty three) The constraints depending on , yes No. eigenvalues, when it is semi-positive definite, we have And the constraint function express , and then by Fan Ji's theorem we get: (twenty four) Formula (23) is solved by the following formula:

[0048] (25) in and is a non-negative tuning parameter, Represents the characteristics of the feature space after reduction. By solving formula (25), a high-quality graph is obtained.

[0049] In step 4, a graph convolutional neural network model based on spectral clustering is constructed, and the graph structure data optimized in step 3 is input into the model for network protocol classification. Use hypergraphs for semi-supervised classification of nodes and define an undirected hypergraph ,in represents a vertex, Represents edges, and also a small set of labeled supernodes , each supernode is associated with a feature vector ,in is the number of dimensions, The key is the graph Laplace operator, the definition of Laplace operator is as follows, The calculation formula is as follows, 1) For each hyperedge ,make , 2) Set the weight to Edge Add to Vertex On the top, construct a weighted graph ,in For super edge The weight of Add a self-loop on the vertex The degree in is equal to ,set up express The weighted adjacency matrix of 3) The symmetric normalized hypergraph Laplace function is: (26) After obtaining the adjacency matrix and the feature matrix composed of all node features, the graph convolution operation is performed by transferring aggregate information between nodes through formula (27). A three-layer GCN with randomly initialized weights is used to capture the structure of the entire graph. The node features are aggregated in the last layer for classification, and finally a global attention mechanism is used for output.

[0050] (27) in, Added self-connected undirected graph The adjacency matrix of It is a unit array; is a layer-specific trainable weight matrix; represents the activation function; It is The activation matrix of the layer, and .

[0051] Set up a simulation comparison experiment of the classification algorithm, use two different classification methods in addition to the method: GNN, CNN to conduct classification experiments on the same graph structure, take the average of the results in 20 iterations and compare the convergence of the objective function. Figure 2 During the training process, all sample features X are used to construct the feature matrix. All sample features refer to all features in the graph structure established by the spectral clustering algorithm, and 10%, 20%, 30%, 40% and 50% of the labeled samples of three different models are used for construction and evaluation. In addition, 10% of the samples are selected as the validation set, and the remaining samples are used for testing.

[0052] The accuracy rate (ACC) is used as the evaluation indicator of the experimental results, which is defined as: , in, is the total number of samples, is the number of samples that can be correctly classified.

[0053] Table 2 Comparison of different composition methods and sample selection results

[0054] Table 2 lists the average classification accuracy of the three graph composition methods. It can be seen that S-GCN has better performance than other algorithms. When 10%, 20%, and 30% of the samples are selected as training sets on datasets with different graph structures, S-GCN significantly outperforms the other three methods. In addition, it is not difficult to see that the accuracy obtained by selecting different sample ratios is different, and the accuracy relationship is as follows: Figure 3 When 30% of the samples are selected as the training set, S-GCN outperforms the comparison methods, improving by 3.0% and 4.1% over KNN and CLR, respectively.

[0055] We use t-distributed stochastic neighbor embedding (t-SNE) to reduce the dimension of the clustering results to two dimensions for visualization. Figure 4 , shows 2D t-SNE visualization by different methods, and uses different colors to identify different categories. It can be seen that in the convolutional layer feature representation of S-GCN, the same classes are closely connected, while different classes are clearly divided.

[0056] like Figure 5 The convergence curve of the objective function value is shown. The value of the objective function is monotonically decreasing until the proposed algorithm converges. In addition, the proposed objective function converges in 20 iterations, and the convergence speed is also faster than the other two methods. Therefore, the rapid convergence of the objective function proves the effectiveness of the method.

[0057] It should be noted that the above embodiments are not intended to limit the protection scope of the present invention, and equivalent changes or substitutions made on the basis of the above technical solutions all fall within the protection scope of the claims of the present invention.

Claims

1. A graph convolutional neural network protocol classification method based on spectral clustering composition, characterized in that: The following steps are involved: Step 1: Filter out key fields from all network protocols from the physical layer to the application layer in the data set to generate a new data set; Step 2: Combine subspace learning and attribute selection to optimize the traditional spectral clustering algorithm, and construct the data set processed in step 1 using the optimized spectral clustering algorithm; Step 3: Optimize the graph structure of the spectral clustering result graph in step 2; Step 4: Build a graph convolutional neural network model based on spectral clustering composition, and input the graph structure data optimized in step 3 into the model for network protocol classification.

2. According to claim 1, a graph convolutional neural network protocol classification method based on spectral clustering composition is characterized in that: In step 1: In the original data set, the message contains all fields from the physical layer to the application layer. The data set needs to be processed and the key fields need to be filtered. Step 1-1, split the data set into traffic segments. Step 1-2: perform traffic redundancy removal on the data set. Step 1-3, select fields from the data set. Steps 1-4, unify the dataset length and labels, Steps 1-5, generate a new dataset.

3. According to claim 1, a graph convolutional neural network protocol classification method based on spectral clustering composition is characterized in that: In step 2: After preprocessing the data, the protocol data is converted into a matrix form, where each row is a message and each column is a different feature of the message, and the data matrix is ​​obtained. ,Depend on data matrix consisting of data, each sample has Features, using spectral clustering composition algorithm for composition, as follows: Step 2-1: Construct a similarity graph matrix based on the input data matrix , Step 2-2: Construct the Laplacian matrix based on the similarity graph matrix , Step 2-3: Perform feature decomposition before extraction The eigenvector corresponding to the smallest eigenvalue is used to construct the spectral representation matrix , Step 2-4: Use K-means clustering to divide the spectral representation and obtain the clustering results , Step 2-5: Analyze and verify the clustering results.

4. According to claim 3, a graph convolutional neural network protocol classification method based on spectral clustering composition is characterized in that ,The spectral clustering graph construction algorithm is optimized as follows: For the original sample and , and its similarity is , through the transformation matrix The original data is projected from the original feature space to the low-dimensional feature subspace. At the same time, the samples in the low-dimensional space and The local structure between them remains unchanged, which can be expressed as: （1） in, is the parameter of the Gaussian kernel. Bray-Curtis distance is used to calculate the distance. The formula is as follows: （2） in, , Respectively, vector , Each characteristic component of Use orthogonal constraints to transform the matrix Constraints are imposed, and the objective function of LPP is obtained as follows: (3) in, , represents a diagonal matrix, It is a unit array. is an orthogonal constraint used to generate uncorrelated spectral vectors, with diagonal elements equal to the similarity graph matrix The row vector sum of Right now ,Use the hypergraph to construct the Laplacian matrix, and then use the hypergraph Laplacian matrix constraint spectrum to express, formula (3) is rewritten as: （4） in, is a hypergraph Laplacian matrix, Embedding attribute selection into the subspace learning framework, （5） in, is a row sparse matrix, non-negative is a tuning parameter that balances subspace learning and attribute selection during the learning process, In the subsequent clustering process, the spectral rotation clustering method is used to embed the spectral rotation clustering into the spectral representation learning framework to complete one-step clustering. The objective function is as follows: （6） in, is the tuning coefficient, Solve the objective function formula (6), First, initialize the indicator matrix , transformation matrix and the identity matrix ,Then, an iterative loop is entered and the loop will continue until the convergence criterion defined by formula (6) is met. During this iteration, the transformation matrix The update follows these three steps: Step (1) starts an inner iteration loop that executes until the transformation matrix The update of satisfies the convergence condition specified by formula (7), Step (2) In the inner loop, firstly transform the transformation matrix according to formula (11): Update, then GPI framework to matrix Update, and finally update the matrix according to formula (13) To update, Step (3) These steps will be repeated until the transformation matrix The update of reaches the convergence standard set by formula (7), After the above inner loop is completed, according to formula (15) The matrix is ​​updated, and then according to formula (16) After completing these update steps, return to the outer iteration loop and continue to update the transformation matrix , until the convergence criterion defined by formula (6) is met, the entire iterative process continues until the transformation matrix The update of satisfies the convergence condition of the outer loop, right Update, In the right When updating, you need to fix and , then solving the objective function is equivalent to solving formula (7), （7） Using the framework of iterative weighted least squares to solve the non-smooth problem of formula (7), formula (7) becomes the following: （8） in is a hypergraph diagonal matrix whose diagonal elements are , The alternating direction multiplication operator framework is used to decompose the complex problem into multiple easy-to-solve sub-problems. Then formula (8) becomes the following: （9） After the transformation of the above formula, the optimization problem is converted into three sub-problems to be solved: （10） against , , To update, Set the value to 1. The derivative of is set to 0, which gives The closed solution is: （11） and The update is achieved directly through the transformation: （12） in , When calculated and After that, we get The optimization is performed by formula (13) Optimization: （13） right Update, In Update When you need to fix and , then the objective function becomes the following formula: （14） is an indicator matrix whose elements There are only two values ​​0 and 1. Yes The solution of formula (14) is as follows: （15） right Update, renew Need to and If is fixed, the objective function is equivalent to the following: （16） Minimize formula (16), which is equivalent to: （17） Re-establish and About The left and right singular matrices of the singular value decomposition of the point are: （18） The non-orthogonal clustering indicator matrix is ​​replaced by the standard orthogonal scaling clustering indicator matrix to minimize the difference between the two standard orthogonal matrices. The closed-form solution of is: (19)。 5. According to claim 1, a graph convolutional neural network protocol classification method based on spectral clustering composition is characterized in that: Step 3: Optimize the graph structure of the spectral clustering result graph in step 2, as follows: The data set processed in step 2 , define The probability of samples and all data points is Connect to A neighbor of Determined by the following formula: （20） Find a linear combination that is closest to the original features of the low-dimensional manifold, as follows: （21） Agree on a binding letter ,in is the similarity graph matrix The number of connected components in is given by With the initial graph Fitting: （22） in is the updated Laplacian matrix, the initial graph is the graph obtained from step 3, Using graph learning and Sparse learning can solve the noise and outlier problems, as shown below: （23） The constraints depending on , yes No. eigenvalues, when it is semi-positive definite, we have And the constraint function express , and then from Fan Ji's theorem we get: （24） Formula (23) is solved by the following formula: （25） in is a non-negative tuning parameter, Represents the characteristics of the feature space after reduction. By solving formula (25), a high-quality graph is obtained.

6. According to claim 1, a graph convolutional neural network protocol classification method based on spectral clustering composition is characterized in that: In step 4, a graph convolutional neural network model based on spectral clustering is constructed, and the graph structure data optimized in step 3 is input into the model for network protocol classification. Use hypergraphs for semi-supervised classification of nodes and define an undirected hypergraph ,in represents a vertex, Represents edges, and also a small set of labeled supernodes , each supernode is associated with a feature vector ,in is the number of dimensions, The key is the graph Laplace operator, the definition of Laplace operator is as follows, The calculation formula is as follows: 1) For each hyperedge ,make , 2) Set the weight to Edge Add to Vertex On the top, construct a weighted graph ,in For super edge The weight of Add a self-loop on the vertex The degree in is equal to ,set up express The weighted adjacency matrix of 3) The symmetric normalized hypergraph Laplace function is: （26） After obtaining the adjacency matrix and the feature matrix composed of all node features, the graph convolution operation is performed by transferring aggregate information between nodes through formula (27). A three-layer GCN with randomly initialized weights is used to capture the structure of the entire graph. In the last layer, the node features are aggregated for classification, and finally a global attention mechanism is used for output. （27） in, Added self-connected undirected graph The adjacency matrix of It is a unit array; is a layer-specific trainable weight matrix; represents the activation function; It is The activation matrix of the layer, and .

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the graph convolutional neural network protocol classification method based on spectral clustering composition is implemented as described in any one of claims 1 to 6.

8. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instruction is executed by the processor, the graph convolutional neural network protocol classification method based on spectral clustering composition is implemented as described in any one of claims 1-6.

Images