Abnormal host identification method, system and device and readable storage medium

Abstract

The invention provides an abnormal host identification method, system and device and a readable storage medium, and belongs to the technical field of information security. The method comprises the following steps: mapping a host and an access relationship in a network into a graph structure, after accumulating flow data, extracting node features by using a graph attention network, and averaging feature vectors of a plurality of time periods to obtain a representation vector of each node; preprocessing network flow data, replacing the representation vector of the node with the network flow data, forming training data, constructing an LSTM model for training and verification, and obtaining a univariate time sequence prediction model; inputting the flow data of the to-be-detected host into the univariate time sequence prediction model to obtain a prediction result; and evaluating an abnormal value of the to-be-detected host based on the prediction result to determine whether the to-be-detected host is an abnormal host. According to the method, the advantages of the GAT model and the LSTM model are combined, and the abnormal behavior of the host in the network domain is accurately detected and judged.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more specifically to an abnormal host identification method, system, device and readable storage medium. Background Art

[0002] With the rapid development of the Internet and various network applications, the scale of the network is getting larger and larger, the amount of data transmitted is increasing, and the impact on network and information security is increasing. At present, various attacks on computers are emerging in an endless stream. Although the attack detection method based on feature analysis can warn of some attack methods, as the attack methods become more and more diverse and the internal threats become more and more severe, computers will still be at great risk of being attacked and infiltrated. Anomaly detection can not only detect unknown attacks, but also be used to detect internal threats. Therefore, the anomaly detection system for hosts has received more and more attention. The key to anomaly detection is to compare the normal behavior of the host observed in the past with the current behavior characteristics of the host. If the deviation between the two is large enough, it means that an anomaly has occurred and a warning is issued to the administrator.

[0003] There are many solutions for abnormal host identification at present, which mainly include two categories: traditional machine learning solutions and deep learning solutions.

[0004] Traditional machine learning techniques generally first extract several statistical features from the original data packets based on expert knowledge, then use Random Forest (RF), Support Vector Machine (SVM), decision tree, naive Bayes, etc. to train classifiers, and finally implement abnormal host classification on the test set. However, with the continuous expansion of network boundaries and network applications, network data has surged, and traditional machine learning methods can no longer efficiently process massive and complex traffic data.

[0005] Deep learning solutions can automatically extract features from raw data without human intervention. This type of method can achieve good feature retention and effectively utilize the data correlation in the raw data, such as using RNN to retain the temporal characteristics of the data, or using graph convolutional networks (GCN) to retain node features and graph structure information in node vectorization representation. However, deep learning models usually require a large amount of high-quality training data to achieve good performance, but in practical applications, such data is often difficult to obtain. Deep learning models are usually more complex, and the training and inference processes may require a lot of computing resources and time; in addition, the model's interpretability is relatively poor, and it is difficult to intuitively understand the model's decision-making process and output results. Summary of the invention

[0006] In view of the above problems, the purpose of the present invention is to provide an abnormal host identification method, system, device and readable storage medium, which combine the advantages of GAT and LSTM models to achieve accurate detection and judgment of abnormal behavior of hosts in the network domain.

[0007] In order to achieve the above object, the present invention is implemented through the following technical solutions: In a first aspect, the present invention discloses a method for identifying an abnormal host, comprising: The host and access relationships in the network are mapped into a graph structure. After accumulating traffic data, the graph attention network is used to extract node features, and the representation vector of each node is obtained by averaging the feature vectors of multiple time periods. Preprocess the network traffic data, use it to replace the node representation vector, form training data, build an LSTM model for training and verification, and obtain a univariate time series prediction model; The traffic data of the host to be detected is input into a univariate time series prediction model to obtain a prediction result; based on the prediction result, the abnormal value of the host to be detected is evaluated to determine whether the host to be detected is an abnormal host.

[0008] Furthermore, the host and access relationships in the network are mapped into a graph structure. After accumulating traffic data, the graph attention network is used to extract node features, and the representation vector of each node is obtained by averaging the feature vectors of multiple time periods; Preprocess the network traffic data, use it to replace the node representation vector, form training data, build an LSTM model for training and verification, and obtain a univariate time series prediction model; The traffic data of the host to be detected is input into a univariate time series prediction model to obtain a prediction result; based on the prediction result, the abnormal value of the host to be detected is evaluated to determine whether the host to be detected is an abnormal host. Furthermore, the traffic data includes but is not limited to source IP address, destination IP address, communication port, data packet size, and communication time. Furthermore, the preprocessing of network traffic data, using the representation vectors of its nodes to form training data, constructing an LSTM model for training and verification, and obtaining a univariate time series prediction model includes the following steps: S201: Obtain historical traffic data of the network, perform data preprocessing, group them by source host, and arrange them in chronological order. Based on the processed host data, replace the representation vector of the corresponding node to form a one-dimensional vector array as training data; S202: construct an LSTM model, select the time window length of the input layer, and set the number of features according to the length of the node representation vector; S203: Use the training data to train and verify the LSTM model to minimize the prediction error and obtain a univariate time series prediction model.

[0009] Further, the flow data of the host to be detected is input into a univariate time series prediction model to obtain a prediction result; and the abnormal value of the host to be detected is evaluated based on the prediction result to determine whether the host to be detected is an abnormal host, including the following steps: S301: Select nearly T records of the traffic data of the host to be detected, process them according to the processing method of step S201, and input them into the univariate time series prediction model to obtain the prediction result of the host to be detected at time t+1 ; S302: Obtain the host node actually accessed by the host to be detected at time t+1, recorded as ;calculate and The cosine distance is denoted as ; S303: Repeat the process of step S301 to step S302 X times, and calculate the average value of the X cosine distances as the abnormal value of the host to be detected; S304: Determine whether the abnormal value of the host to be detected is greater than the risk threshold. If so, the host to be detected is an abnormal host.

[0010] Furthermore, the value of X is 10. Furthermore, k is any integer between 10 and 100.

[0011] In a second aspect, the present invention further discloses an abnormal host identification system, comprising: The host node representation module is used to map the host and access relationship in the network into a graph structure. After accumulating traffic data, the graph attention network is used to extract node features, and the representation vector of each node is obtained by averaging the feature vectors of multiple time periods. The model building module is used to preprocess the network traffic data, replace the node representation vector with it, form training data, build the LSTM model for training and verification, and obtain the univariate time series prediction model; The anomaly determination module is used to input the traffic data of the host to be detected into the univariate time series prediction model to obtain the prediction result; based on the prediction result, the anomaly value of the host to be detected is evaluated to determine whether the host to be detected is an abnormal host.

[0012] In a third aspect, the present invention further discloses an abnormal host identification device, comprising: A memory, used for storing an abnormal host identification program; A processor is used to implement the steps of any of the above-mentioned abnormal host identification methods when executing the abnormal host identification program.

[0013] In a fourth aspect, the present invention further discloses a readable storage medium, on which is stored an abnormal host identification program, which, when executed by a processor, implements the steps of the abnormal host identification method as described in any one of the above items.

[0014] Compared with the prior art, the present invention has the following beneficial effects: 1. By combining the graph attention network (GAT) and the long short-term memory network (LSTM), the present invention can deeply explore the complex relationship between hosts and accurately predict the future access of hosts, significantly improving the accuracy of anomaly detection. The present invention as a whole reasonably combines GAT and LSTM, fully utilizes the network topology characteristics, and uses the historical access of the host to build a prediction model. In the calculation of the host anomaly value, it also avoids the limitation of occasional deviation of a single prediction, so that the present invention has a strong generalization ability.

[0015] 2. The present invention can adjust parameters according to the actual situation of the network environment, such as time interval, time window length, etc. This flexibility ensures that the model can perform well in network environments of different scales and complexities, thereby enhancing the generalization ability of the model.

[0016] 3. The present invention realizes the node representation of the host by constructing a graph, constructs a graph by dividing the traffic data of a period of time according to time periods, and calculates the average vector of the node by accumulating multiple graphs in multiple time periods, thereby maximizing the use of the network topology.

[0017] 4. The present invention can collect and process network traffic data in real time and automatically determine abnormalities based on advanced prediction models. This substantial improvement in real-time and automation enables network security managers to respond to and handle potential security threats more quickly.

[0018] It can be seen that compared with the prior art, the present invention has outstanding substantive features and significant progress, and the beneficial effects of its implementation are also obvious. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0020] Figure 1It is a method flow chart of a specific implementation mode of the present invention.

[0021] Figure 2 It is a system structure diagram of a specific implementation mode of the present invention.

[0022] Figure 3 It is a schematic diagram of the device structure in a specific implementation manner of the present invention.

[0023] In the figure, 1. Host node characterization module; 2. Model building module; 3. Abnormal determination module; 101. Processor; 102. Memory; 103. Input interface; 104. Output interface; 105. Communication unit; 106. Keyboard; 107. Display; 108. Mouse. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the scheme of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0025] See also Figure 1 As shown, this embodiment provides a method for identifying an abnormal host, comprising the following steps: S1: Map the host and access relationship in the network into a graph structure. After accumulating traffic data, use the graph attention network to extract node features, and obtain the representation vector of each node by averaging the feature vectors of multiple time periods.

[0026] As an example, in this step, we first implement the node representation of the host by building a graph, map the host to a graph node, map the access relationship between the hosts to the edge between the nodes, accumulate the traffic data for a period of time, organize this part of the traffic data into graph structure data, and then extract features from the graph structure data based on a neural network model.

[0027] S2: Preprocess the network traffic data, use it to replace the node representation vector, form training data, build an LSTM model for training and verification, and obtain a univariate time series prediction model.

[0028] As an example, the historical traffic data of the network domain is first processed and summarized to form training data. Then, with the help of LSTM's long-dependency processing capabilities, the node historical data is trained to form a univariate time prediction model for anomaly determination.

[0029] S3: Input the traffic data of the host to be detected into a univariate time series prediction model to obtain a prediction result; evaluate the abnormal value of the host to be detected based on the prediction result to determine whether the host to be detected is an abnormal host.

[0030] In this embodiment, an abnormal host determination scheme is provided through the processing of three stages: host node characterization, univariate time series model training, and anomaly determination. This scheme not only comprehensively considers the network structure characteristics, but also overcomes the difficulty that the anomaly determination method often requires a large amount of high-quality labeled data. This method has high accuracy and a wide range of applications.

[0031] In an embodiment of the present invention, based on step S1, a possible embodiment is given below to illustrate its specific implementation scheme in a non-limiting manner.

[0032] Step S1 implements host node characterization, which specifically includes the following sub-steps: S101: Define each host in the network as a node of a graph, define the edges in the graph according to the access relationship between the hosts, and set the weights of the edges according to the access frequency and the number of data packets to generate a network access graph.

[0033] As an example, first, each host in the network is defined as a node in the graph. These nodes represent entities in the network and are the basic units for subsequent feature extraction and anomaly identification.

[0034] Next, the edges in the graph are defined based on the access relationships between hosts. If there is direct or indirect communication (such as TCP / IP connection) between two hosts, an edge is drawn between the two nodes. The weight of the edge can be set based on the frequency of access, the number of packets, or other relevant indicators to reflect the strength of the access relationship.

[0035] S102: Continuously collect traffic data in the network within a preset time period, pre-process the traffic data, and update corresponding data based on the network access graph to form structured graph data.

[0036] As an example, within a certain period of time, for example, using i minutes as the time interval (i is an integer between 5 and 60 depending on the network activity), the traffic data in the network is continuously collected. This includes but is not limited to key information such as source IP address, destination IP address, communication port, data packet size, communication time, etc.

[0037] The collected traffic data is preprocessed to remove redundant and erroneous data to ensure the accuracy and consistency of the data. At the same time, the traffic data is sorted according to the host and access relationship to form structured graph data.

[0038] S103: Use the graph attention network model to extract features from the graph structure data and generate a feature vector for each node.

[0039] As an example, the GAT model is used to extract features from graph structure data. The GAT model can effectively capture the relationship between nodes through the attention mechanism, thereby extracting the feature representation of each node. These features not only contain the attributes of the node itself, but also integrate the information of its neighboring nodes, making the features richer and more representative.

[0040] After being processed by the GAT model, each node will generate a feature vector V.

[0041] S104: Repeat steps S102 to S103 in k preset time periods to obtain k feature vectors of each node; for each node, calculate the average value of the k feature vectors to obtain a characterization vector of each node.

[0042] As an example, the above sub-steps S102 to S103 provide a method for calculating the feature vector of each node in the network domain within a period of time, accumulating k time intervals, and k is usually an integer between 10-100 according to the network activity. Sub-steps S102 to S103 are repeated, and then k vectors of each node are obtained, and the average vector is taken to obtain the representation vector of each node. These feature vectors will be used as the input of the subsequent LSTM model for further time series analysis and anomaly detection.

[0043] In an embodiment of the present invention, based on step S2, a possible embodiment is given below to illustrate its specific implementation scheme in a non-limiting manner.

[0044] Step S2 implements the univariate time series model training, which specifically includes the following sub-steps: S201: Obtain historical traffic data of the network, perform data preprocessing, group them by source host, and arrange them in chronological order. Based on the processed host data, replace the representation vector of the corresponding node to form a one-dimensional vector array as training data.

[0045] As an example, the network traffic information in the network domain is preprocessed. The key operation steps include: grouping by source host, arranging in chronological order (usually selecting data from the past month), retaining only the target host column data, and replacing the node representation vector of the host node.

[0046] After this step, a one-dimensional vector array array[V1, V2, V3...] will be obtained for each host.

[0047] S202: Build an LSTM model, select the time window length of the input layer, and set the number of features according to the length of the node representation vector.

[0048] As an example, we first build the model. In the input layer, we select the time window length T and the number of features as the length F of the node representation vector V. Then the input dimension is (T, F). Based on experience, F is selected as 10.

[0049] The activation function uses the tanh activation function.

[0050] The fully connected layer uses 1-2 layers, which can be selected according to the size of the network. For a smaller network, one fully connected layer is sufficient, and for a complex network, two fully connected layers are recommended. At the same time, the dimension of the final output tensor is changed, which needs to be set to the length F of the node vector V.

[0051] S203: Use the training data to train and verify the LSTM model to minimize the prediction error and obtain a univariate time series prediction model.

[0052] As an example, the LSTM model is trained and validated using training data. During the training process, the model parameters are adjusted through the back propagation algorithm to minimize the prediction error; at the same time, the model is validated using the validation set to evaluate the model's performance and prevent overfitting.

[0053] In an embodiment of the present invention, based on step S3, a possible embodiment is given below to illustrate its specific implementation scheme in a non-limiting manner.

[0054] Step S3 provides a method for determining host abnormality by comprehensively comparing the predicted results with the actual results, which specifically includes the following sub-steps: S301: Select nearly T records of the traffic data of the host to be detected, process them according to the processing method of step S201, and input them into the univariate time series prediction model to obtain the prediction result of the host to be detected at time t+1 .

[0055] S302: Obtain the host node actually accessed by the host to be detected at time t+1, recorded as ;calculate and The cosine distance is denoted as .

[0056] S303: Repeat the process from step S301 to step S302 X times, and calculate the average value of the X cosine distances as the abnormal value of the host to be detected.

[0057] Here, the value of X is 10.

[0058] S304: Determine whether the abnormal value of the host to be detected is greater than the risk threshold. If so, the host to be detected is an abnormal host.

[0059] It should be noted that the risk threshold setting is greatly affected by factors such as the network environment. The risk threshold setting value can be given by combining statistical analysis with empirical judgment based on the historical data obtained in sub-step S2011.

[0060] See also Figure 2 As shown, the present invention also discloses an abnormal host identification system, including: a host node characterization module 1, a model construction module 2 and an abnormality determination module 3. The host node characterization module 1 is used to map the host and access relationship in the network into a graph structure. After accumulating traffic data, the graph attention network is used to extract node features, and the characterization vector of each node is obtained by averaging the feature vectors of multiple time periods.

[0061] Model building module 2 is used to preprocess network traffic data, replace the node representation vector with it, form training data, build an LSTM model for training and verification, and obtain a univariate time series prediction model.

[0062] The abnormality determination module 3 is used to input the traffic data of the host to be detected into the univariate time series prediction model to obtain the prediction result; based on the prediction result, the abnormal value of the host to be detected is evaluated to determine whether the host to be detected is an abnormal host.

[0063] The specific implementation of the abnormal host identification system of this embodiment is basically the same as the specific implementation of the abnormal host identification method described above, and will not be repeated here.

[0064] See also Figure 3 As shown, the present invention also discloses an abnormal host identification device, including a processor 101 and a memory 102; wherein, when the processor 101 executes the abnormal host identification program stored in the memory, the steps of the abnormal host identification method as described in any one of the above items are implemented.

[0065] The abnormal host identification device provided in this embodiment may include but is not limited to a smart phone, a tablet computer, a laptop computer or a desktop computer.

[0066] Among them, the processor 101 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 101 can be implemented in at least one hardware form of a digital signal processor (DSP), a field-programmable gate array (FPGA), and a programmable logic array (PLA). The processor 101 may also include a main processor and a coprocessor. The main processor is a processor for processing data in an awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor for processing data in a standby state. In some embodiments, the processor 101 may be integrated with a graphics processing unit (GPU), and the GPU is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 101 may also include an artificial intelligence (AI) processor, which is used to process computing operations related to machine learning.

[0067] The memory 102 may include one or more computer-readable storage media, which may be non-transitory. The memory 102 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 102 is at least used to store the following computer program, wherein, after the computer program is loaded and executed by the processor 101, the relevant steps of the abnormal host identification method disclosed in any of the aforementioned embodiments can be implemented. In addition, the resources stored in the memory 102 may also include an operating system and data, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system may include Windows, Unix, Linux, etc. The data may include, but is not limited to, the data involved in the above-mentioned abnormal host identification method, etc.

[0068] Furthermore, the abnormal host identification device in this embodiment may also include: The input interface 103 is used to obtain an abnormal host identification program imported from the outside, and save the obtained abnormal host identification program to the memory 102. It can also be used to obtain various instructions and parameters transmitted by external terminal devices, and transmit them to the processor 101, so that the processor 101 can use the above various instructions and parameters to carry out corresponding processing. In this embodiment, the input interface 103 can specifically include but is not limited to a USB interface, a serial interface, a voice input interface, a fingerprint input interface, a hard disk reading interface, etc.

[0069] The output interface 104 is used to output various data generated by the processor 101 to a terminal device connected thereto, so that other terminal devices connected to the output interface can obtain various data generated by the processor 101. In this embodiment, the output interface 104 may specifically include but is not limited to a USB interface, a serial interface, and the like.

[0070] The communication unit 105 is used to establish a remote communication connection between the server operation service optimization configuration device and the external server so that the abnormal host identification device can mount the image file to the external server. In this embodiment, the communication unit 105 may specifically include but is not limited to a remote communication unit based on wireless communication technology or wired communication technology.

[0071] The keyboard 106 is used to obtain various parameter data or instructions input by the user by tapping the keycaps in real time.

[0072] The display 107 is used to display relevant information of the abnormal host identification process in real time.

[0073] The mouse 108 can be used to assist the user in inputting data and simplify the user's operation.

[0074] The present invention also discloses a readable storage medium, wherein the readable storage medium includes a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable hard disk, a CD-ROM or any other form of storage medium known in the technical field. The readable storage medium stores an abnormal host identification program, and when the abnormal host identification program is executed by a processor, the steps of the abnormal host identification method described in any one of the above items are implemented.

[0075] In summary, the present invention combines the advantages of GAT and LSTM models to achieve accurate detection and judgment of abnormal behaviors of hosts in the network domain.

[0076] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. As for the method disclosed in the embodiment, since it corresponds to the system disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0077] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0078] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of systems or units, which can be electrical, mechanical or other forms.

[0079] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0080] In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, or each module may exist physically separately, or two or more modules may be integrated into one unit.

[0081] Similarly, each processing unit in each embodiment of the present invention may be integrated into one functional module, or each processing unit may exist physically, or two or more processing units may be integrated into one functional module.

[0082] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0083] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0084] The above is a detailed introduction to the abnormal host identification method, system, device and readable storage medium provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principle of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the scope of protection of the present invention.

Claims

1. A method for identifying an abnormal host, characterized in that: include: The host and access relationships in the network are mapped into a graph structure. After accumulating traffic data, the graph attention network is used to extract node features, and the representation vector of each node is obtained by averaging the feature vectors of multiple time periods. Preprocess the network traffic data, use it to replace the node representation vector, form training data, build an LSTM model for training and verification, and obtain a univariate time series prediction model; The traffic data of the host to be detected is input into a univariate time series prediction model to obtain a prediction result; based on the prediction result, the abnormal value of the host to be detected is evaluated to determine whether the host to be detected is an abnormal host.

2. The abnormal host identification method according to claim 1, characterized in that: The host and access relationship in the network is mapped into a graph structure, and after accumulating traffic data, the graph attention network is used to extract node features, and the representation vector of each node is obtained by averaging the feature vectors of multiple time periods, including the following steps: S101: define each host in the network as a node of a graph, define edges in the graph according to access relationships between the hosts, and set edge weights according to access frequencies and the number of data packets to generate a network access graph; S102: continuously collecting traffic data in the network within a preset time period, preprocessing the traffic data, and updating corresponding data based on the network access graph to form structured graph data; S103: Use the graph attention network model to extract features from the graph structure data and generate a feature vector for each node; S104: Repeat steps S102 to S103 in k preset time periods to obtain k feature vectors of each node; for each node, calculate the average value of the k feature vectors to obtain a characterization vector of each node.

3. The abnormal host identification method according to claim 2, characterized in that: The traffic data includes but is not limited to source IP address, destination IP address, communication port, data packet size, and communication time.

4. The abnormal host identification method according to claim 2, characterized in that: The preprocessing of network traffic data, using the representation vectors of its nodes to form training data, constructing an LSTM model for training and verification, and obtaining a univariate time series prediction model includes the following steps: S201: Obtain historical traffic data of the network, perform data preprocessing, group them by source host, and arrange them in chronological order. Based on the processed host data, replace the representation vector of the corresponding node to form a one-dimensional vector array as training data; S202: construct an LSTM model, select the time window length of the input layer, and set the number of features according to the length of the node representation vector; S203: Use the training data to train and verify the LSTM model to minimize the prediction error and obtain a univariate time series prediction model.

5. The abnormal host identification method according to claim 4, characterized in that: The method of inputting the traffic data of the host to be detected into a univariate time series prediction model to obtain a prediction result; and evaluating the abnormal value of the host to be detected based on the prediction result to determine whether the host to be detected is an abnormal host, comprises the following steps: S301: Select nearly T records of the traffic data of the host to be detected, process them according to the processing method of step S201, and input them into the univariate time series prediction model to obtain the prediction result of the host to be detected at time t+1 ; S302: Obtain the host node actually accessed by the host to be detected at time t+1, recorded as ;calculate and The cosine distance is denoted as ; S303: Repeat the process from step S301 to step S302 X times, and calculate the average value of the X cosine distances as the abnormal value of the host to be detected; S304: Determine whether the abnormal value of the host to be detected is greater than the risk threshold. If so, the host to be detected is an abnormal host.

6. The abnormal host identification method according to claim 5, characterized in that: The value of X is 10.

7. The abnormal host identification method according to claim 2, characterized in that: The k is any integer between 10 and 100.

8. An abnormal host identification system, characterized in that: include: The host node representation module is used to map the host and access relationship in the network into a graph structure. After accumulating traffic data, the graph attention network is used to extract node features, and the representation vector of each node is obtained by averaging the feature vectors of multiple time periods. The model building module is used to preprocess the network traffic data, replace the node representation vector with it, form training data, build the LSTM model for training and verification, and obtain the univariate time series prediction model; The anomaly determination module is used to input the traffic data of the host to be detected into the univariate time series prediction model to obtain the prediction result; based on the prediction result, the anomaly value of the host to be detected is evaluated to determine whether the host to be detected is an abnormal host.

9. An abnormal host identification device, characterized in that: include: A memory, used for storing an abnormal host identification program; A processor, configured to implement the steps of the abnormal host identification method according to any one of claims 1 to 7 when executing the abnormal host identification program.

10. A readable storage medium, characterized in that: An abnormal host identification program is stored on the readable storage medium, and when the abnormal host identification program is executed by the processor, the steps of the abnormal host identification method according to any one of claims 1 to 7 are implemented.

Images