Network traffic anomaly intrusion detection method and system combining GAN and GNN

Abstract

The invention discloses a GAN and GNN combined network traffic anomaly intrusion detection method and system. The method comprises the following steps: acquiring original network traffic data; carrying out data preprocessing on the original network flow data, wherein the data preprocessing comprises the step of realizing data sample enhancement by adopting a GAN (Generic Area Network); inputting the data subjected to data preprocessing into a pre-constructed GNN network model for training; and inputting to-be-detected network traffic data into the trained GNN network model, and outputting a corresponding prediction result. According to the method, the GAN is adopted to process unbalanced data, diversified samples are generated, classification is carried out through the improved graph neural network GNN, complex relations and structural features in large-scale network traffic are efficiently captured, and therefore the accuracy and robustness of detection are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network traffic anomaly intrusion detection, and more specifically to a network traffic anomaly intrusion detection method and system combining GAN (Generative Adversarial Networks) and GNN (Graph Neural Network). Background Art

[0002] At present, intrusion detection systems detect intrusions based on anomaly detection methods. By comparing abnormal behaviors with normal behaviors and combining feature-based detection methods, they can effectively identify abnormal behaviors and unusual patterns that deviate from the baseline of normal traffic by comparing them with pre-configured and predetermined attack patterns called features, thereby identifying potential intrusions and attacks and improving the ability to prevent network security threats.

[0003] Although anomaly detection technology can identify known and unknown attacks, its effectiveness is affected by many factors, including data quality, changes in data distribution, and the adaptability of the selected modeling method. With the continuous evolution of network attack methods, traditional rule-based detection methods have become incapable of adapting to complex security requirements. At the same time, the rapid development of machine learning technology has made anomaly detection methods based on machine learning widely used in intrusion detection systems.

[0004] However, traditional machine learning has many limitations when processing data, such as reliance on the assumption of data independence, the need for manual feature engineering, lack of contextual information capture, and poor scalability. This makes it difficult to effectively handle the complex relationships of real network traffic data. Moreover, traditional machine learning methods are limited to using a single stream as input data, ignoring the sequence characteristics of the stream, limiting the ability of the classifier to model feature distribution in a single stream, and therefore showing a high false alarm rate. Moreover, network traffic data often has large-scale and high-dimensional features, which places higher requirements on the computing resources required for modeling and brings challenges to hardware conditions.

[0005] Therefore, considering the timing characteristics, large data volume and high feature dimension of network data flow, how to design a scientific and reliable detection method is an urgent problem that technical personnel in this field need to solve. Summary of the invention

[0006] In view of this, the present invention provides a network traffic anomaly intrusion detection method and system combining GAN and GNN. By constructing an efficient and accurate network traffic anomaly intrusion detection system, while ensuring high detection performance, the model's demand for computing resources is reduced, and efficient real-time detection is achieved to cope with increasingly complex network security threats.

[0007] In order to achieve the above object, the present invention adopts the following technical solution:

[0008] In a first aspect, an embodiment of the present invention provides a network traffic anomaly intrusion detection method combining GAN and GNN, including:

[0009] Get raw network traffic data;

[0010] Performing data preprocessing on the original network traffic data, including using a GAN network to enhance data samples;

[0011] Inputting the data after the data preprocessing into a pre-built GNN network model for training;

[0012] Input the network traffic data to be tested into the trained GNN network model and output the corresponding prediction results.

[0013] Furthermore, the data preprocessing specifically includes:

[0014] Filter the original network traffic data through protocol filtering and time window to obtain flow data;

[0015] Performing data cleaning and feature selection on the flow data to obtain statistical features describing flow behavior;

[0016] Based on the statistical features, a GAN network is used to generate resampled abnormal samples to obtain normal traffic and abnormal traffic data with a balanced ratio;

[0017] Standardizing and normalizing the normal flow and abnormal flow data;

[0018] The standardized and normalized traffic data is used to construct a graph structure.

[0019] Furthermore, the GAN network is a generative adversarial network, which includes two neural networks: a generator B and a discriminator D;

[0020] in,

[0021] The generator B obtains actual noise data and generates synthetic data;

[0022] The actual noise data and the synthetic data are input into the discriminator D for training, and the probability value of judging the actual noise data and the synthetic data is output;

[0023] The generator B and the discriminator D are continuously adjusted until the actual noise data and the synthesized data cannot be distinguished.

[0024] Furthermore, the objective functions of the generator B and the discriminator D are:

[0025]

[0026]

[0027] It is concluded that the GAN network is a minimum-maximum problem min B max D Y(B,D), the value function Y(B,D) is:

[0028]

[0029] Where z represents randomly generated noise, Indicates that the noise variable z is taken from a prior distribution P z Expected value; Indicates that the real data x is taken from the data set distribution P data The expected value on; B(z) represents the generator B trying to get from the noise P z Learn a distribution P from the distribution of B , and make P B Close to actual data P data distribution.

[0030] Furthermore, the training process of the GNN network model specifically includes:

[0031] 1) Node sampling: Use the attention mechanism to calculate the attention coefficient, sample the two-hop neighbor nodes according to the size of the attention coefficient, and adjust the sampling ratio and number of samples according to the size of the graph and the connection density of the nodes;

[0032] 2) Node aggregation: According to the attention coefficient, the features of the two-hop neighbor nodes are weightedly aggregated to obtain the final embedding representation of the node;

[0033] 3) Traffic classification: The final embedded representation of each node is input into a fully connected classification layer, and the probability of each category is output through the Softmax function and compared with the preset threshold; when the probability exceeds the preset threshold, it is judged as abnormal traffic.

[0034] Furthermore, the node sampling step specifically includes:

[0035] 1.1) Generate multi-hop neighbor connections:

[0036] Suppose graph G = (V, E), where V and E represent the node set and edge set of graph G respectively. Taking the neighbor nodes connected by two hops as an example, edges will be created between the two-hop neighbors by adding the square of the adjacency matrix, forming an expansion of the edges and a stacking of GNN layers:

[0037] E'={nm|sign(A+A 2 )>0,n≠m}

[0038] Generate a new graph G' of two-hop neighbor connections:

[0039] G'=(V,E')

[0040] Construct a two-hop connected neighborhood set N(n) about the target node n 0 :

[0041] N(n) 0 ={m:n∈V,nm∈E'}

[0042] Where A is the adjacency matrix of graph G, V is its node set, E′ is the edge set expanded by two-hop neighbor connections, sign represents a mathematical function used to judge the input value, outputs 1 when the input value is greater than zero, otherwise outputs 0, and node m is a neighbor node of node n;

[0043] 1.2) Calculate the attention weight e between two-hop neighbor nodes mn :

[0044]

[0045] Where a represents a learnable weight vector, which is used to measure the similarity of two node features; W represents a linear transformation matrix, which maps the input features to a low-dimensional space; h m and h n represents the features of nodes m and n; || represents the feature concatenation operation; attention weight e mn Indicates the influence of two-hop neighbor node m on target node n;

[0046] 1.3) The unnormalized attention weights e of all neighbor nodes mn Through the normalization of the softmax function, the attention coefficient α of the two-hop neighbor node is obtained mn :

[0047]

[0048] 1.4) According to the attention coefficient α mn The size of the graph is used to sample the two-hop neighbor nodes, and the sampling ratio and number of samples are adjusted according to the size of the graph and the connection density of the nodes.

[0049] Furthermore, in step 1.4), according to the attention coefficient α mn The size of the graph is used to sample two-hop neighbor nodes, and the sampling ratio and number of samples are adjusted according to the size of the graph and the connection density of the nodes; specifically, the following are included:

[0050] Determine the sampling ratio according to the image size. The formula is:

[0051]

[0052] Calculate the sampling ratio factor p:

[0053]

[0054] Calculate the specific sampling number S of each node v n :

[0055]

[0056] Among them, |N| is the total number of nodes in the graph, |E| is the total number of edges in the graph, and the sampling ratio is the average number of neighbors connected to each node in the graph; C is a constant controlling the sampling scale, and the sampling ratio coefficient p∈(0,1]; represents the total number of neighbor nodes of node n, round represents rounding, and max(1,·) means that each node samples at least one neighbor to avoid node information loss.

[0057] Furthermore, the node aggregation specifically includes:

[0058] 2.1) For each node n, the feature h of the neighboring nodes m and the corresponding attention weight α mn Perform weighted summation to obtain the aggregated node feature representation:

[0059]

[0060] is the new feature representation obtained by aggregating node n from its two-hop neighbor nodes;

[0061] Using a multi-head attention mechanism, each head has different weights and attention coefficients:

[0062]

[0063] 2.2) Using residual connection, the initial features are merged with the new features after aggregation to obtain the node feature representation:

[0064]

[0065] in, is the new feature representation obtained by the aggregation of the multi-head attention mechanism; K is the number of attention heads; is the normalized attention coefficient of the kth head; W k is the weight matrix of the kth head; W k h mis the linear transformation of neighbor node features to ensure that all features are aggregated in the same dimension; σ is the ReLU activation function; is the final feature representation of node n; W′ is a linear transformation matrix, representing all W k The mean value of the matrix;

[0066] 2.3) After calculating the node features in each layer, they are updated by the features of the previous layer and the aggregated neighborhood information. The update of each layer is combined with the current embedding h of the node n And neighborhood embedding, the new node feature formula obtained by layer l aggregation is:

[0067]

[0068] The aggregation results of the multi-head attention mechanism at each layer are combined with the transformed original node features W′e n Splicing them together, we get the final embedding representation of the node:

[0069]

[0070] in, is the embedding representation of node n at layer l.

[0071] Furthermore, the traffic classification specifically includes:

[0072] The final embedding representation z of each node n Input to a fully connected classification layer and output the probability of each category through the Softmax function;

[0073] The probability distribution y formula output by the classification layer is:

[0074] y=Softmax(W out ·z n +b)

[0075] The probability y of the category to which the node belongs is determined and compared with the preset threshold. If it exceeds the preset threshold, it is judged as abnormal traffic; otherwise, it is normal traffic;

[0076] Among them, W out is the weight matrix of the fully connected layer; b is the bias term; y is the model's predicted probability distribution of the category to which the node belongs.

[0077] In a second aspect, an embodiment of the present invention provides a network traffic anomaly intrusion detection system combining GAN and GNN, including the following modules:

[0078] Acquisition module: used to obtain original network traffic data;

[0079] Data preprocessing module: used for performing data preprocessing on the original network traffic data, including using a GAN network to enhance data samples;

[0080] Model training module: used to input the data after the data preprocessing into the pre-built GNN network model for training;

[0081] Result prediction module: used to input the network traffic data to be detected into the trained GNN network model and output the corresponding prediction results.

[0082] It can be seen from the above technical solutions that, compared with the prior art, the present invention has the following technical effects:

[0083] In the data preprocessing stage: through feature selection, redundant features and interference information in the network data flow are effectively removed, effectively alleviating the negative impact of irregular data on the model; generative adversarial networks are used to process unbalanced data, which reduces the false alarm rate of the model and improves the model detection effect; by using graph structures to effectively capture the feature distribution between large-scale data streams, the classifier's ability to recognize abnormal flows and the model scalability are improved.

[0084] During the neural network model training phase, we used node embedding to encode nodes into low-dimensional vectors to achieve data dimensionality reduction and combined multi-hop neighbor aggregation, reducing computational overhead. We combined the attention mechanism to select the most important neighbor node embeddings to improve the classifier's ability to identify abnormal flows. We also achieved high interpretability of the results through visualization of node embeddings.

[0085] The present invention not only considers network traffic as sequence data, but also takes into account local characteristics, so that the model can better adapt to various complex problems; it integrates different neural network algorithms to improve the performance and generalization of the detection method. BRIEF DESCRIPTION OF THE DRAWINGS

[0086] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0087] Figure 1 This is a flow chart of the network traffic anomaly intrusion detection method provided by the present invention.

[0088] Figure 2 The present invention provides a flowchart of data preprocessing.

[0089] Figure 3A schematic diagram of a model of a generative adversarial network (GAN) provided by the present invention.

[0090] Figure 4 A schematic diagram of the model of the graph neural network GNN provided by the present invention. DETAILED DESCRIPTION

[0091] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0092] First, the network terms used in the embodiments of the present invention are explained:

[0093] GAN: The full English name is Generative Adversarial Network, and the Chinese name is Generative Adversarial Network; it consists of two parts, the generator and the discriminator, and the relationship between them can be described as competitive or hostile.

[0094] GNN: The full English name is Graph Neural Networks, and the Chinese name is Graph Neural Network. It is a neural network that is good at processing large-scale and high-dimensional graph data.

[0095] Embodiment 1

[0096] The embodiment of the present invention discloses a network traffic anomaly intrusion detection method combining GAN and GNN, referring to Figure 1 As shown, including:

[0097] Get raw network traffic data;

[0098] Perform data preprocessing on the original network traffic data, including using the GAN network to enhance data samples;

[0099] Input the pre-processed data into the pre-built GNN network model for training;

[0100] Input the network traffic data to be tested into the trained GNN network model and output the corresponding prediction results.

[0101] A generative adversarial network is used to process unbalanced data. The representativeness of the training set is enhanced by resampling the minority class sample data to generate diverse samples. Classification is performed through an improved graph neural network to efficiently capture the complex relationships and structural features in large-scale network traffic, thereby improving the accuracy and robustness of detection.

[0102] The present invention not only improves the feature extraction capability, but also optimizes the performance and efficiency of the model. Through effective data preprocessing and 1-hop node embedding steps, we encode nodes into low-dimensional vectors to achieve data dimensionality reduction and reduce computational overhead, so that the system can still maintain high-accuracy anomaly detection capabilities under limited resources, and achieve high interpretability of the results through visualization of node embedding, and finally build an efficient intrusion detection system with good interpretability.

[0103] The specific implementation steps of this embodiment are as follows:

[0104] Step 1: Obtain original network traffic data;

[0105] Collect the original network data stream from the network communication, that is, the object detected by the present invention. The network communication contains the source IP address, destination IP address, connection direction, source port number, destination port number, transport layer protocol type of stream connection (such as TCP, UDP, etc.), dynamic detection protocol type (such as DNS, HTTP, SLL, etc.), connection status (such as connection not replayed, connection established, connection attempt rejected, etc.), data packet size, number of data packets, flow frequency, data packet connection time, etc., which are recorded in units of streams with integrity and consistency metadata, and a data sequence of bytes with a starting point and an end point.

[0106] Data sources usually include real-time network traffic, log files, host and server monitoring data, system call records, etc.; they aim to collect diverse network traffic data to provide a basis for subsequent processing and modeling.

[0107] Step 2: preprocessing the original network traffic data;

[0108] The data preprocessing process in this embodiment refers to Figure 2 As shown, it is divided into six parts: data collection, data cleaning, feature selection, unbalanced data processing, data standardization and normalization, and graph construction.

[0109] 1) Data collection: Through protocol filtering (such as TCP, UDP, etc.) and time window screening, we obtain metadata records with integrity and consistency in units of streams, including source IP address, destination IP address, connection direction, source port number, destination port number, connection protocol type, connection status, data packet size, number of data packets, data stream connection duration, etc. This record contains bidirectional information from source address to destination address and from destination address to source address, and the source and destination addresses do not overlap.

[0110] 2) Data cleaning: Since the obtained streaming data may contain a large number of missing values, infinite values, negative values, duplicate records, and incorrect format information, it is necessary to identify and remove irrelevant or damaged data, delete duplicate or incorrectly formatted records, modify infinite values ​​to the maximum value of the column, delete missing values, and replace negative values ​​with the minimum value of the column.

[0111] The purpose of data cleaning in this embodiment is to remove missing values, redundant values ​​and outliers in the original data to ensure the accuracy and consistency of the data and the absence of anomalies that may have a negative impact on the performance of the model.

[0112] 3) Feature selection: Network flow data consists of the following three parts: source address, destination address, and flow features. Here we mainly focus on endpoint identifiers such as IP address, port number, protocol, and flow direction, packet size, number of packets, flow frequency, duration, and other statistical features that describe flow behavior.

[0113] The purpose of feature selection in this embodiment is to extract the most helpful features for anomaly detection from the original data to improve the training efficiency and detection performance of the model.

[0114] 4) Unbalanced data processing: In network traffic data, normal traffic is usually much greater than abnormal traffic, resulting in highly unbalanced data and affecting the detection effect of the model. Figure 3 As shown, a generative adversarial network is used to generate resampled abnormal samples to balance the ratio of normal traffic and abnormal traffic.

[0115] In this embodiment, GAN includes two neural networks, one neural network B creates new data instances, and the other neural network D evaluates the authenticity of the data. GAN generates more representative abnormal samples through adversarial training of generator B and discriminator D, so that the diversity and quantity of abnormal data are enhanced. In this way, the proportion of abnormal samples in the training data is more reasonable, so that the subsequent classification model can more effectively identify abnormal traffic and reduce the false alarm rate.

[0116] The implementation of GAN is mainly an adversarial process. The goal of B is to create data that the discriminator D wants to identify. That is, B generates new data and passes it to D. From the perspective of B, it is hoped that the generated fake data will look like a real data. On the other hand, the goal of D is to identify the image passed from B as a forgery.

[0117] In this embodiment, the GAN operation is as follows:

[0118] B receives an arbitrary number and returns it as data. The generated data and real data obtained from the actual dataset are passed to D. D distinguishes between real data and synthetic data and returns a probability value between 0 and 1. 1 represents a real image and 0 represents a fake image. z is randomly generated noise, and B(z) represents the number of pixels that generator B tries to generate from the noise P. z Learn a distribution P from the distribution of B , and make P B As close as possible to the actual data P data The discriminator D tries to identify whether the sample is real. Continue to adjust B and D until D cannot distinguish between real data and generated data during training, that is, P B =P data B tries to confuse D, but D will try its best to distinguish between normal samples and generated samples. Therefore, this embodiment defines the objective functions of B and D as follows:

[0119]

[0120]

[0121] Therefore, GAN is described as a minimum-maximum problem. B max D Y(B,D), where the value function Y(B,D) is:

[0122]

[0123] in, Indicates that the noise variable Z is taken from a prior distribution P z Expected value; Indicates that the real data x is taken from the data set distribution P data Expected value on.

[0124] When real data is inserted, it outputs a larger value, and when fake data is inserted, it outputs a smaller value. Because it is constantly generating synthetic data, as learning continues, the classification model becomes more robust to changes in the data.

[0125] 5) Data standardization and normalization: After data balancing, the data needs to be standardized and normalized to eliminate the dimensional differences between different features and ensure the stability and convergence speed of model training.

[0126] Standardization: Transform the data into a standard normal distribution with zero mean and unit variance to balance the scale differences between different features.

[0127] Normalization: Scale the data to the [0,1] interval. This step helps to enhance the stability of the model and accelerate the convergence of the deep learning model during training, avoids the model from being biased due to the absolute size difference of the feature values, and ensures that the model can smoothly and efficiently process different types of feature data.

[0128] 6) Graph construction: In order to better capture the correlation between traffic and more complex network topology information, the system constructs the traffic data into a graph structure and inputs it into the graph neural network for learning to improve the ability to recognize abnormal patterns.

[0129] This embodiment constructs network traffic into a graph structure, and uses IP addresses, port numbers, and flows to construct edges and nodes; specifically, the general graph structure uses source IP addresses and port numbers to be combined to identify graph nodes, as do destination addresses and ports; the remaining traffic data is used as edge features, and graph nodes are featureless. In this way, the intrusion detection problem is encoded as an edge classification task; but since static graph neural networks are usually used to process node classification tasks, the original graph data is converted into a line graph; that is, its nodes correspond to original edges, edges correspond to original nodes, and node features are original edge features. Since in all data, the source and destination addresses do not overlap, this embodiment constructs a bipartite graph G(V,E), where V and E represent node sets and edge sets, respectively.

[0130] Step 3: Input the pre-processed data into the pre-built GNN network model for training;

[0131] This embodiment constructs a graph neural network model, referring to Figure 4 As shown in the figure, it consists of three parts: node sampling, node aggregation and fully connected classification layer. The specific implementation process is as follows:

[0132] 1) Node sampling

[0133] The attention mechanism is used to calculate the attention coefficient to measure the importance of multi-hop connected neighbor nodes, so as to select the most influential nodes from the multi-hop neighbors of each node for information aggregation.

[0134] This embodiment takes the neighbor nodes of two-hop connection as an example. By adding the square of the adjacency matrix, edges will be created between the two-hop neighbors, forming edge expansion and GNN layer stacking; the neighbors of each node within two hops can be obtained through 1-hop sampling. The specific steps are as follows:

[0135] 1.1) Generate multi-hop neighbor connections:

[0136] Taking the neighbor nodes of two-hop connection as an example, let graph G = (V, E), where V and E represent the node set and edge set of graph G respectively. By adding the square of the adjacency matrix, edges will be created between the two-hop neighbors, forming an expansion of the edges and a stacking of GNN layers:

[0137] E'={nm|sign(A+A 2 )>0,n≠m}

[0138] Generate a new graph G' of two-hop neighbor connections:

[0139] G'=(V,E')

[0140] Construct a two-hop connected neighborhood set N(n) about the target node n 0 :

[0141] N(n) 0 ={m:n∈V,nm∈E'}

[0142] Where A is the adjacency matrix of graph G, V is its node set, E′ is the edge set expanded by two-hop neighbor connections, sign is a mathematical function used to judge the input value, outputs 1 when the input value is greater than zero, otherwise outputs 0, and node m is a neighbor node of n;

[0143] 1.2) Attention weight calculation:

[0144] Let the target node be n, and node m∈N(n) is a neighbor node of n, where N(n) is the neighborhood set of node set V, defined as {m:n∈V, mn∈E}. Calculate the attention weight e between two-hop neighbor nodes mn :

[0145]

[0146] Among them, a is a learnable weight vector used to measure the similarity of two node features; W is a linear transformation matrix that maps the input features to a low-dimensional space; h n and h m are the features of nodes n and m; || represents the feature concatenation operation. Attention score e mn Indicates the influence of two-hop neighbor node m on target node n.

[0147] 1.2) The unnormalized attention weights e of all neighbor nodes mn Through the normalization of the softmax function, the attention coefficient α of the two-hop neighbor node is obtained mn :

[0148]

[0149] After normalization, α mnRepresents the relative importance of node m to node n.

[0150] 1.3) According to the attention coefficient α mn The size of the two-hop neighbor nodes is sampled. In order to dynamically determine the number of fixed-size samples, the sampling number is determined according to a certain ratio of the size of the graph and the connection density of the nodes, and the fixed-size and most important neighbor nodes are selected for information aggregation. The specific calculation is as follows:

[0151] First, the sampling ratio is determined according to the image size.

[0152] If the total number of nodes in the graph is |N| and the total number of edges is |E|, the average degree of the graph (that is, the average number of neighbors of each node) is used to dynamically set the sampling ratio. The average degree is:

[0153]

[0154] Represents the average number of neighbors connected to each node in the graph, that is, the sampling ratio.

[0155] Next, the sampling ratio coefficient p is calculated.

[0156] Set a sampling ratio coefficient p∈(0,1] to indicate the ratio of each node sampling from its neighbors. The sampling ratio p can be dynamically calculated by the following formula:

[0157]

[0158] Wherein, C is a constant used to control the sampling scale. In this embodiment, C can take an appropriate value (5, 10, etc.) to adjust the upper limit of the sampling ratio. If is large, p will be relatively small to reduce the number of samples in the overcrowded graph; if is small, p will approach 1, ensuring that enough neighbor nodes can be sampled in the sparse graph.

[0159] Finally, the number of samples is calculated.

[0160] After setting the sampling ratio p, the specific sampling number S of each node v can be calculated n :

[0161]

[0162] in, represents the total number of neighbor nodes of node v; round represents rounding operation to make the sampled number an integer; max(1,·) is used to ensure that each node samples at least one neighbor to avoid node information loss.

[0163] This design can dynamically adjust the sampling ratio and number of samples according to the size and density of the graph, making the sampling mechanism adaptable to graph data of different sizes.

[0164] 2) Node aggregation

[0165] The node features are updated in each layer by combining the features of the previous layer and the aggregated neighborhood information. The update of each layer combines the current embedding h of the node and the neighborhood embedding, and applies the attention weight and nonlinear function to form the updated embedding. In order to retain the original feature information of the node, the graph neural network model uses residual connection to fuse the initial features with the aggregated features. Using the attention coefficient α calculated previously mn , weighted aggregation of the features of two-hop neighbor nodes. The specific implementation is as follows:

[0166] 2.1) Weighted aggregation of two-hop neighbor node features

[0167] For each node n, the features h of the neighboring nodes are m and the corresponding attention weight α mn Perform weighted summation to obtain the aggregated node feature representation:

[0168]

[0169] It is the new feature representation of node n aggregated from its two-hop neighbor nodes.

[0170] In order to further improve the expressiveness of the model, this embodiment adds a multi-head attention mechanism, that is, multiple attention heads are used during aggregation, and each head has different weights and attention coefficients:

[0171]

[0172] Where K represents the number of attention heads; is the normalized attention coefficient of the kth head; W k is the weight matrix of the kth head; W k h m is a linear transformation of neighbor node features to ensure that all features are aggregated on the same dimension.

[0173] 2.2) Residual Connection

[0174] In order to retain the original feature information of the node, the graph neural network model uses residual connection to fuse the initial features with the aggregated features. The obtained node feature representation is:

[0175]

[0176] Where σ is the ReLU activation function; is the final feature representation of node n, which contains its initial features and feature information aggregated from neighboring nodes; W′ is another linear transformation matrix, which can be all W k The average value of the matrix. n The converted results are residually connected with the features of the aggregation results to enhance the expressiveness of the features.

[0177] 2.3) Calculate the final node feature representation output

[0178] After calculating the node features in each layer, they are updated by the features of the previous layer and the aggregated neighborhood information. The update of each layer is combined with the current embedding h of the node. n And neighborhood embedding, the new node feature obtained by layer l aggregation is updated as follows:

[0179]

[0180] in, is the embedding representation of node n at layer l.

[0181] Finally, the aggregation results of the multi-head attention mechanism at each layer are combined with the transformed original node features W′e n Stitched together, the final node represents the final output:

[0182]

[0183] 3) Traffic classification

[0184] This embodiment processes each layer of aggregated features layer by layer to finally obtain a high-dimensional embedding representation of the node. These aggregated features can effectively capture the relationship between nodes and local network structure information, especially with the help of the attention mechanism, they can highlight the features reflecting abnormal traffic.

[0185] For each node, the final embedding representation z n , we input it into a fully connected classification layer, and finally output the probability of each category through the Softmax function. The formula is as follows:

[0186] y=Softmax(W out ·z n +b)

[0187] Among them, W out is the weight matrix of the fully connected layer; b is the bias term; y is the model's predicted probability distribution for the category to which the node belongs.

[0188] Through the probability distribution y output by the classification layer, the model can determine the category to which the node belongs, that is, normal or abnormal traffic. Finally, it is compared with a set threshold. When the abnormal classification probability of a node exceeds the threshold, it is judged as abnormal traffic; otherwise, it is normal traffic.

[0189] Step 4: Input the network traffic data to be detected into the trained GNN network model, and output the probability of the traffic category prediction result through the Softmax function;

[0190] The prediction result probability output by the model is compared with the set threshold; if it exceeds the threshold, it is abnormal traffic; otherwise, it is normal traffic.

[0191] In this embodiment, after the result classification is obtained, the matplotlib python toolkit is used to visualize the nodes, with green representing normal nodes and red representing abnormal nodes. Through the visualization of node embedding, it is clear which traffic is abnormal, and the result is highly interpretable.

[0192] This embodiment uses a graph neural network in combination with an attention mechanism with residual connections to aggregate neighbors and update the central node representation. In the process of learning weighted aggregation, the attention coefficient of the entire neighborhood is calculated, and a fixed number of neighbors with greater attention are selected proportionally for aggregation according to the size of the graph. In addition, when calculating attention, not only adjacent first-order neighbor nodes are considered, but also multi-hop connected nodes are considered, which involves edge enhancement and stacking of GNN layers. Therefore, the results of multi-hop aggregation of other models can be achieved by using smaller hop aggregation, which greatly reduces the calculation time and improves the calculation efficiency.

[0193] Embodiment 2

[0194] The embodiment of the present invention discloses a network traffic anomaly intrusion detection system combining GAN and GNN, including the following modules:

[0195] Acquisition module: used to obtain original network traffic data;

[0196] Data preprocessing module: used for performing data preprocessing on the original network traffic data, including using a GAN network to enhance data samples;

[0197] Model training module: used to input the data after the data preprocessing into the pre-built GNN network model for training;

[0198] Result prediction module: used to input the network traffic data to be detected into the trained GNN network model and output the corresponding prediction results.

[0199] This embodiment uses the trained graph neural network model to build a complete system from data collection to anomaly detection. The system can be deployed behind a firewall, on a server, etc. to monitor the network in real time, and based on the detection results output by the system, an alarm is issued so that security personnel can make subsequent processing.

[0200] The detection accuracy of the system of the present invention is high; through data preprocessing feature selection, redundant features and interference information in the network data stream are effectively removed, and the negative impact of irregular data on the model is effectively alleviated; through the processing of unbalanced data, the false alarm rate of the model is reduced, and the model detection effect is improved;

[0201] By using graph structures to effectively capture the feature distribution between large-scale data streams, the classifier's ability to identify abnormal flows and the model's scalability are improved. By using node embedding to encode nodes into low-dimensional vectors, data dimensionality reduction and multi-hop neighbor aggregation are achieved, reducing computational overhead.

[0202] By combining the attention mechanism to select the most important neighbor node embedding, the classifier's ability to identify abnormal flows is improved; by visualizing the node embedding, the results are highly interpretable;

[0203] While considering network traffic as sequence data, local characteristics are also taken into account, so that the model can better adapt to various complex problems; different neural network algorithms are integrated to improve the performance and generalization of the detection method.

[0204] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0205] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A network traffic anomaly intrusion detection method combining GAN and GNN, characterized in that: include: Get raw network traffic data; Performing data preprocessing on the original network traffic data, including using a GAN network to enhance data samples; Inputting the data after the data preprocessing into a pre-built GNN network model for training; Input the network traffic data to be tested into the trained GNN network model and output the corresponding prediction results.

2. A network traffic anomaly intrusion detection method combining GAN and GNN as claimed in claim 1, characterized in that: The data preprocessing specifically includes: Filter the original network traffic data through protocol filtering and time window to obtain flow data; Performing data cleaning and feature selection on the flow data to obtain statistical features describing flow behavior; Based on the statistical features, a GAN network is used to generate resampled abnormal samples to obtain normal traffic and abnormal traffic data with a balanced ratio; Standardizing and normalizing the normal flow and abnormal flow data; The standardized and normalized traffic data is constructed into a graph structure.

3. A network traffic anomaly intrusion detection method combining GAN and GNN as claimed in claim 2, characterized in that: The GAN network is a generative adversarial network, which includes two neural networks: a generator B and a discriminator D; in, The generator B obtains actual noise data and generates synthetic data; The actual noise data and the synthetic data are input into the discriminator D for training, and the probability value of judging the actual noise data and the synthetic data is output; The generator B and the discriminator D are continuously adjusted until the actual noise data and the synthesized data cannot be distinguished.

4. A network traffic anomaly intrusion detection method combining GAN and GNN as claimed in claim 3, characterized in that: The objective functions of the generator B and the discriminator D are: It is concluded that the GAN network is a minimum-maximum problem min B max D Y(B,D), the value function Y(B,D) is: Where z represents randomly generated noise, Indicates that the noise variable z is taken from a prior distribution P z Expected value; Indicates that the real data x is taken from the data set distribution P data The expected value on; B(z) represents the generator B trying to get from the noise P z Learn a distribution P from the distribution of B , and make P B Close to actual data P data distribution.

5. A network traffic anomaly intrusion detection method combining GAN and GNN as claimed in claim 1, characterized in that: The training process of the GNN network model specifically includes: 1) Node sampling: Use the attention mechanism to calculate the attention coefficient, sample the two-hop neighbor nodes according to the size of the attention coefficient, and adjust the sampling ratio and number of samples according to the size of the graph and the connection density of the nodes; 2) Node aggregation: According to the attention coefficient, the features of the two-hop neighbor nodes are weightedly aggregated to obtain the final embedding representation of the node; 3) Traffic classification: The final embedded representation of each node is input into a fully connected classification layer, and the probability of each category is output through the Softmax function and compared with the preset threshold; when the probability exceeds the preset threshold, it is judged as abnormal traffic.

6. A network traffic anomaly intrusion detection method combining GAN and GNN as claimed in claim 5, characterized in that: The node sampling step specifically includes: 1.1) Generate multi-hop neighbor connections: Taking the neighbor nodes of two-hop connection as an example, let graph G = (V, E), where V and E represent the node set and edge set of graph G respectively. By adding the square of the adjacency matrix, edges will be created between the two-hop neighbors, forming an expansion of the edges and a stacking of GNN layers: E'={nm|sign(A+A 2 )>0,n≠m} Generate a new graph G' of two-hop neighbor connections: G'=(V,E') Construct a two-hop connected neighborhood set N(n) about the target node n 0 : N(n) 0 ={m:n∈V,nm∈E'} Where A is the adjacency matrix of graph G, V is its node set, E′ is the edge set expanded by two-hop neighbor connections, sign represents a mathematical function used to judge the input value, outputs 1 when the input value is greater than zero, otherwise outputs 0, and node m is a neighbor node of node n; 1.2) Calculate the attention weight e between two-hop neighbor nodes mn : Where a represents a learnable weight vector, which is used to measure the similarity of two node features; W represents a linear transformation matrix, which maps the input features to a low-dimensional space; h n and h m represents the features of nodes n and m; || represents the feature concatenation operation; the attention weight e mn Indicates the influence of two-hop neighbor node m on target node n; 1.3) The unnormalized attention weights e of all neighbor nodes mn Through the normalization of the softmax function, the attention coefficient α of the two-hop neighbor node is obtained mn : 1.4) According to the attention coefficient α mn The size of the graph is used to sample the two-hop neighbor nodes, and the sampling ratio and number of samples are adjusted according to the size of the graph and the connection density of the nodes.

7. A network traffic anomaly intrusion detection method combining GAN and GNN as claimed in claim 6, characterized in that: In the step 1.4), according to the attention coefficient α mn The size of the graph is used to sample two-hop neighbor nodes, and the sampling ratio and number of samples are adjusted according to the size of the graph and the connection density of the nodes; specifically, the following are included: Determine the sampling ratio according to the image size. The formula is: Calculate the sampling ratio factor p: Calculate the specific sampling number S for each node n n : Among them, |N| is the total number of nodes in the graph, |E| is the total number of edges in the graph, and the sampling ratio is the average number of neighbors connected to each node in the graph; C is a constant controlling the sampling scale, and the sampling ratio coefficient p∈(0,1]; represents the total number of neighbor nodes of node n, round represents rounding, and max(1,·) means that each node samples at least one neighbor to avoid node information loss.

8. A network traffic anomaly intrusion detection method combining GAN and GNN as claimed in claim 5, characterized in that: The node aggregation specifically includes: 2.1) For each node n, the feature h of the neighboring nodes m and the corresponding attention weight α mn Perform weighted summation to obtain the aggregated node feature representation: is the new feature representation obtained by aggregating node n from its two-hop neighbor nodes; Using a multi-head attention mechanism, each head has different weights and attention coefficients: 2.2) Using residual connection, the initial features are merged with the new features after aggregation to obtain the node feature representation: in, is the new feature representation obtained by the aggregation of the multi-head attention mechanism; K is the number of attention heads; is the normalized attention coefficient of the kth head; W k is the weight matrix of the kth head; W k h m is the linear transformation of neighbor node features to ensure that all features are aggregated in the same dimension; σ is the ReLU activation function; is the final feature representation of node n; W′ is a linear transformation matrix, representing all W k The mean value of the matrix; 2.3) After calculating the node features in each layer, they are updated by the features of the previous layer and the aggregated neighborhood information. The update of each layer is combined with the current embedding h of the node n And neighborhood embedding, the new node feature formula obtained by layer l aggregation is: The aggregation results of the multi-head attention mechanism at each layer are combined with the transformed original node features W′e n Splicing them together, we get the final embedding representation of the node: in, is the embedding representation of node n at layer l.

9. A network traffic anomaly intrusion detection method combining GAN and GNN as claimed in claim 5, characterized in that: The traffic classification specifically includes: The final embedding representation z of each node n Input to a fully connected classification layer and output the probability of each category through the Softmax function; The probability distribution y formula output by the classification layer is: y=Softmax(W out ·z n +b) The probability y of the category to which the node belongs is determined and compared with the preset threshold. If it exceeds the preset threshold, it is judged as abnormal traffic; otherwise, it is normal traffic; Among them, W out is the weight matrix of the fully connected layer; b is the bias term; y is the model's predicted probability distribution of the category to which the node belongs.

10. A network traffic anomaly intrusion detection system combining GAN and GNN, characterized in that: Includes the following modules: Acquisition module: used to obtain original network traffic data; Data preprocessing module: used for performing data preprocessing on the original network traffic data, including using a GAN network to enhance data samples; Model training module: used to input the data after the data preprocessing into the pre-built GNN network model for training; Result prediction module: used to input the network traffic data to be detected into the trained GNN network model and output the corresponding prediction results.

Images