Botnet detection method and system based on feature selection and feature fusion

Abstract

The invention discloses a Botnet detection method and system based on feature selection and feature fusion, and the method comprises the steps: obtaining to-be-detected network traffic, and extracting M statistical features from the to-be-detected network traffic; the M statistical features are screened, and N optimal features are screened out; constructing a host feature vector based on the N optimal features; constructing a triple list of the network traffic to be detected based on the host feature vector; based on the triple list of the network traffic, constructing a graph structure of the network traffic to be detected; and inputting the network traffic to be detected and the graph structure of the network traffic to be detected into the trained botnet detection model to obtain a botnet detection result. Three advanced models of OrdedGNN, GRU and Linformer are fused, and unified modeling of network flow data structure features and time sequence dependency relationships is realized, so that the accuracy and robustness of botnet detection are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a botnet detection method and system based on feature selection and feature fusion. Background Art

[0002] In recent years, the rapid development of the Internet has greatly facilitated people's lives and work, but at the same time, with the rapid popularization of the Internet, cyber attacks have continued to escalate, causing huge economic losses and data privacy risks to individuals and organizations. Among them, botnets are a highly concealed and destructive form of cyber attacks, which are widely used to launch DDoS attacks, spread malware, send spam, etc., posing a serious threat to the Internet. Botnets are composed of a large number of compromised computers, which are called "zombie hosts" and are subject to remote control by attackers to form a huge botnet. Attackers can use botnets to launch various attacks, causing huge economic losses and social impacts. Therefore, accurate and effective detection of botnets is crucial to maintaining network security.

[0003] Botnet detection is an important branch of network intrusion detection, which mainly studies how to accurately and efficiently discover and identify zombie hosts in the network. Traditional botnet detection methods can be divided into three categories:

[0004] Signature-based detection methods require pre-definition of characteristic patterns of known attack behaviors, matching network traffic with these patterns, and generating an alarm as an attack once a match is found. This method is easy to understand and deploy, but it is difficult to detect unknown attacks, and the cost of maintaining the signature library is high.

[0005] The rule-based detection method analyzes the behavioral characteristics of the botnet, formulates a series of detection rules, and matches the network traffic with the rules to identify potential bot hosts. The detection capability of this type of method depends on the completeness and accuracy of the rule base, and it also has the defect of being unable to discover new attacks.

[0006] Machine learning-based detection methods automatically learn attack patterns and features through training data without the need for manual feature definition. Common algorithms include support vector machines (SVM), decision trees, random forests, etc. These methods improve detection results to a certain extent, but often only use the statistical characteristics of network data and fail to fully explore structural and temporal information.

[0007] The inventors found that network intrusion detection methods based on deep learning have made some progress. Through convolutional neural networks (CNNs), recurrent neural networks (RNNs), etc., high-level feature representations are automatically learned to improve detection performance. However, traditional deep learning models are difficult to capture structural information and temporal dependencies at the same time, and are prone to overfitting. With the rise of graph neural networks (GNNs), some studies have attempted to apply GNNs to botnet detection. GNNs can efficiently mine the topological information of graph structured data, but existing methods generally have problems with over-smoothing and ignore temporal modeling, making it difficult to fully capture the dynamic behavior patterns of botnets. Summary of the invention

[0008] In order to address the shortcomings of the prior art, the present invention provides a botnet detection method and system based on feature selection and feature fusion; it integrates three advanced models, OrderedGNN, GRU and Linformer, to achieve unified modeling of network traffic data structure characteristics and temporal dependencies, thereby significantly improving the accuracy and robustness of botnet detection.

[0009] On the one hand, a botnet detection method based on feature selection and feature fusion is provided, including:

[0010] Obtain the network traffic to be detected, extract M statistical features from the network traffic to be detected; screen the M statistical features to select N optimal features; construct a host feature vector based on the N optimal features; and construct a triple list of the network traffic to be detected based on the host feature vector;

[0011] Based on the triple list of network traffic, a graph structure of the network traffic to be detected is constructed;

[0012] Inputting the network traffic to be detected and the graph structure of the network traffic to be detected into the trained botnet detection model to obtain the botnet detection result;

[0013] The trained botnet detection model includes: Ordered GNN, Linformer module, GRU, feature fusion module and classifier; the Ordered GNN extracts the structured representation of nodes from the graph structure of the network traffic to be detected, the Linformer module fuses the structured representation of the nodes to obtain structural features; the GRU extracts features of the network traffic to be detected to obtain time series features; the feature fusion module fuses the structural features and the time series features to obtain fused features; the classifier classifies the fused features to obtain botnet detection results.

[0014] On the other hand, a botnet detection system based on feature selection and feature fusion is provided, including:

[0015] The acquisition module is configured to: acquire the network traffic to be detected, extract M statistical features from the network traffic to be detected; screen the M statistical features to select N optimal features; construct a host feature vector based on the N optimal features; and construct a triple list of the network traffic to be detected based on the host feature vector;

[0016] A graph structure building module, which is configured to: build a graph structure of the network traffic to be detected based on a triple list of the network traffic;

[0017] A detection module is configured to: input the network traffic to be detected and the graph structure of the network traffic to be detected into the trained botnet detection model to obtain a botnet detection result;

[0018] The trained botnet detection model includes: Ordered GNN, Linformer module, GRU, feature fusion module and classifier; the Ordered GNN extracts the structured representation of nodes from the graph structure of the network traffic to be detected, the Linformer module fuses the structured representation of the nodes to obtain structural features; the GRU extracts features of the network traffic to be detected to obtain time series features; the feature fusion module fuses the structural features and the time series features to obtain fused features; the classifier classifies the fused features to obtain botnet detection results.

[0019] On the other hand, there is also provided an electronic device, comprising:

[0020] a memory for non-transitory storage of computer-readable instructions; and

[0021] a processor for executing the computer readable instructions,

[0022] When the computer-readable instructions are executed by the processor, the method described in the first aspect is executed.

[0023] On the other hand, a storage medium is provided, which non-temporarily stores computer-readable instructions, wherein when the non-temporary computer-readable instructions are executed by a computer, the instructions of the method described in the first aspect are executed.

[0024] On the other hand, a computer program product is provided, comprising a computer program, wherein the computer program is used to implement the method described in the first aspect when running on one or more processors.

[0025] The above technical solution has the following advantages or beneficial effects:

[0026] It integrates three advanced models: OrderedGNN, GRU and Linformer, and realizes unified modeling of the structural characteristics and temporal dependencies of network traffic data, thereby significantly improving the accuracy and robustness of botnet detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0028] Figure 1 This is a schematic diagram of the network structure of Embodiment 1;

[0029] Figure 2 is a flow chart of the method of embodiment 1;

[0030] Figure 3 This is a schematic diagram of feature selection in Example 1;

[0031] Figure 4 Schematic diagram of the internal structure of the Linformer model of Example 1;

[0032] Figure 5 Schematic diagram of the working principle of the Linformer model of Example 1. DETAILED DESCRIPTION

[0033] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0034] Embodiment 1

[0035] This embodiment provides a botnet detection method based on feature selection and feature fusion;

[0036] like Figure 2 As shown in FIG. 1 , the botnet detection method based on feature selection and feature fusion includes:

[0037] S101: Obtain the network traffic to be detected, extract M statistical features from the network traffic to be detected; screen the M statistical features to select N optimal features; construct a host feature vector based on the N optimal features; and construct a triple list of the network traffic to be detected based on the host feature vector;

[0038] S102: constructing a graph structure of the network traffic to be detected based on the triple list of the network traffic;

[0039] S103: inputting the network traffic to be detected and the graph structure of the network traffic to be detected into the trained botnet detection model to obtain a botnet detection result;

[0040] Among them, Figure 1 As shown, the trained botnet detection model includes: Ordered GNN, Linformer module, GRU, feature fusion module and classifier; the Ordered GNN extracts the structured representation of the nodes from the graph structure of the network traffic to be detected, and the Linformer module fuses the structured representation of the nodes to obtain structural features; the GRU extracts features of the network traffic to be detected to obtain time series features; the feature fusion module fuses the structural features and the time series features to obtain fused features; the classifier classifies the fused features to obtain botnet detection results.

[0041] In view of the problem that most existing botnet detection methods only focus on spatial or temporal feature modeling and fail to efficiently utilize two information sources at the same time, the present invention combines the advantages of the Ordered GNN, Linformer and GRU models to achieve unified mining of the structural characteristics and temporal characteristics of network traffic data.

[0042] Furthermore, the S101: obtaining the network traffic to be detected, and extracting M statistical features from the network traffic to be detected, specifically includes:

[0043] Use the CICFlowMeter tool to extract M statistical features from the network traffic to be detected.

[0044] The M statistical features include: basic features, content features and time features; the basic features include: source host IP, destination host IP, source host port, destination host port, protocol; the content features include: payload size, packet header size, TCP flags, average packet size, etc.; the time features include: flow duration, packet arrival time, active time, idle time, etc.

[0045] It should be understood that the CICFlowMeter tool refers to: an open source traffic feature extraction tool that inputs a pcap file and outputs feature information of the data packets contained in the pcap file in the form of a csv table.

[0046] It should be understood that 83 statistical features are extracted from the original network traffic data using the CICFlowMeter tool, and the 20 most important features are selected as host feature vectors based on the information gain rate and the recursive feature elimination algorithm. Figure 2As shown, the present invention uses the CICFlowMeter tool to extract 83 statistical features from the original network traffic data, including basic features (such as source / destination IP, port, etc.), content features (such as payload size, etc.) and time features (such as flow start / end time, etc.).

[0047] Furthermore, the S101: screening the M statistical features to screen out N optimal features includes:

[0048] (11) Calculate the mutual information score between each statistical feature and the target variable;

[0049] (12) Based on the mutual information score, a recursive feature elimination algorithm (RFE) is used to select N optimal features from the M statistical features.

[0050] The N best features are selected based on mutual information score and recursive feature elimination (RFE).

[0051] Furthermore, the (11) calculates the mutual information score between each statistical feature and the target variable, including:

[0052]

[0053] Among them, I(X;Y) represents the mutual information score between feature X and target variable Y, p(x,y) is the joint probability distribution of X and Y, p(x) is the marginal probability distribution of X, p(y) is the marginal probability distribution of Y, x represents the value of feature X, and y represents the value of target variable Y. The value of the target variable is 0 or 1, 0 means the network is a normal network, and 1 means the network is a botnet.

[0054] Furthermore, the (12) uses a recursive feature elimination algorithm RFE based on the mutual information score to select N optimal features from the M statistical features, including:

[0055] (12-1): Calculate the mutual information scores of all M features and the target variable;

[0056] (12-2): Sort the features in descending order according to the mutual information score;

[0057] (12-3): Select the K features with the highest mutual information scores (K>N) to train a random forest classifier model. During training, the input value of the random forest classifier is the feature matrix X composed of the first K features, and the output value of the random forest classifier is the target variable Y. When the training reaches the set number of times, stop training and obtain the trained random forest classifier.

[0058] (12-4): Calculate the importance score of each feature in the random forest classifier model. For a feature j in the random forest, the calculation formula for the importance score I(n,j) is as follows:

[0059] I(n,j)=w n ·(Gini(n)-p L ·Gini L )-p R ·Gini R ));

[0060] Among them, w n is the sample weight of node n, Gini(n) is the Gini impurity of node n, p L and p R are the sample ratios of the left child node and the right child node, n L and n R They are the left child node and the right child node respectively;

[0061] (12-5): Remove the feature with the lowest importance score;

[0062] (12-6): Repeat steps (12-3)-(12-5), removing one feature at a time, until N features remain;

[0063] (12-7): Return the last remaining N features as the optimal feature subset.

[0064] In this way, the RFE (Recursive Feature Elimination) algorithm can consider the interaction between features instead of just relying on the relationship between a single feature and the target variable. This helps select a better feature subset and improve the generalization ability of the model.

[0065] Gini Impurity is an indicator used in decision tree algorithms to measure the purity of a data set. It is often used in the construction of decision trees to help select the best segmentation features and segmentation points. The lower the Gini Impurity, the higher the purity of the data set.

[0066] The calculation formula of Gini impurity is as follows: Where D represents the data set, p i It represents the proportion of samples of the i-th category in the data set, and n represents the total number of categories.

[0067] In the process of calculating the importance of random forest features, the purity of the node is measured by Gini impurity. The importance of the feature is evaluated by calculating the change in Gini impurity before and after the split. The more the impurity caused by the feature is reduced, the more important the feature is.

[0068] Further, the S101: constructing a host feature vector based on the N optimal features includes: arranging the N optimal features in order from left to right to obtain a host feature vector

[0069] Furthermore, the S101: constructing a triple list of network traffic to be detected based on the host feature vector includes: representing the network traffic as a triple list Among them, s i and d i They are the source and destination IP addresses of the communicating hosts respectively.

[0070] Furthermore, the S102: constructing a graph structure of the network traffic to be detected based on the triple list of the network traffic, includes:

[0071] The IP address of each host is taken as a node in the graph structure. Whether there is a communication relationship between the host and other hosts is determined to determine whether there are interconnected edges between the nodes. If there is a communication relationship, there are interconnected edges between the corresponding nodes. If there is no communication relationship, there are no interconnected edges between the corresponding nodes.

[0072] It should be understood that the network traffic data is converted into an undirected graph structure, in which nodes represent IP addresses, edges represent communication relationships between IP addresses, and each node also contains an N-dimensional host feature vector.

[0073] In order to capture the communication structure information in network traffic data, the present invention converts the triple list X into an undirected G = (V, E, F), where V is a node set, E is an edge set, each node v∈V corresponds to a host IP address, F is a node feature matrix, and each row vector corresponds to an N-dimensional feature vector of a host.

[0074] Specifically, if the host s i With host d i If there is communication, then add an undirected edge (s i ,d i ). Through this transformation, network traffic is naturally represented as a graph structure, where different nodes are connected by edges and each node has an independent feature vector.

[0075] Furthermore, the S103: inputting the network traffic to be detected and the graph structure of the network traffic to be detected into the trained botnet detection model to obtain the botnet detection result; the training process of the trained botnet detection model includes:

[0076] Constructing a training set, wherein the training set is network traffic and a graph structure of network traffic of known botnet identification results;

[0077] The training set is input into the botnet detection model to train the model. When the loss function value of the model no longer decreases, the training is stopped to obtain the trained botnet detection model.

[0078] Furthermore, the trained botnet detection model includes: Ordered GNN, Linformer module, GRU, feature fusion module and classifier;

[0079] The input end of the Ordered GNN is used to input the graph structure of the network traffic to be detected. The output end of the Ordered GNN outputs the structured representation of the node. The output end of the Ordered GNN is connected to the input end of the Linformer module. The output end of the Linformer module outputs the structural features. The output end of the Linformer module and the output end of the GRU are both connected to the input end of the feature fusion module. The output end of the feature fusion module is connected to the input end of the classifier. The output end of the classifier outputs the botnet detection result.

[0080] Furthermore, the Ordered GNN extracts the structured representation of nodes from the graph structure of the network traffic to be detected. The Ordered GNN is derived from Song Y, Zhou C, Wang X, et al. Ordered gnn: Ordering messagepassing to deal with heterophily and over-smoothing[J].arXiv preprint arXiv:2302.01524,2023.

[0081] OrderedGNN is a new graph neural network model that aims to solve the problems of heterogeneous information and over-smoothing. It can efficiently mine structural information in graphs and avoid the heterogeneity and over-smoothing defects of traditional graph convolutional networks.

[0082] At layer l, OrderedGNN computes the k-hop neighbor embeddings for node v:

[0083]

[0084] Among them, N k (v) represents the set of k-hop neighbors of node v, It is the node embedding of the previous layer. AGGREGATE is a learnable message passing function, which is responsible for integrating the information of node neighbors. The integration method can be simple averaging or more complex operations, such as weighted averaging, maximum pooling, and degree-based normalized mean pooling.

[0085] Specifically, degree-based normalized mean pooling considers the information of its neighbor nodes for each node in the graph, and normalizes the neighbor nodes according to their degrees when aggregating neighbor information. This normalization can help balance the impact of high-degree and low-degree nodes.

[0086] AGGREGATE is defined as the aggregate message vector of the kth layer of node v when performing a degree-based normalized mean pooling operation on the representation of the node neighbors. Calculated by the following formula:

[0087]

[0088] Among them, N(v) represents the set of direct neighbors of node v, represents the node representation of node u at the k-1th layer, deg(u) represents the degree of node u, that is, the number of edges connected to node u, and SUM represents the summation operation of all neighbor node representations.

[0089] Then, OrderedGNN updates the node embeddings using a gated update strategy:

[0090]

[0091] Among them, U (l) 、V (l,k) , W (l) is a learnable weight matrix used to transform node embeddings and neighbor embeddings, σ is the sigmoid activation function, ⊙ is the element-wise product, and ψ is a nonlinear transformation.

[0092] This strategy can adaptively choose to retain the original representation or aggregate new information, alleviate over-smoothing, and improve representation capabilities.

[0093] After L layers of OrderedGNN, we get the structured embedding of all nodes The nodes and their multi-hop neighborhood structure environment are encoded. OrderedGNN captures the neighborhood information of nodes in different ranges at different levels, and the high-level layer can obtain the global structure representation.

[0094] It should be understood that an ordered graph neural network OrderedGNN is used to extract a structured representation of nodes from the network flow graph structure to solve the over-smoothing problem existing in traditional graph neural networks.

[0095] Linformer is an improved Transformer model that aims to solve the computational complexity problem of the standard Transformer when processing long sequences, reducing the attention computation complexity to the linear level O(n), and has efficient real-time characteristics.

[0096] Furthermore, the Linformer module fuses the structured representations of the nodes to obtain structural features, including:

[0097] Given an OrderedGNN, extract the node embedding sequence at layer L Linformer calculates the fused feature vector of the l-th layer node v:

[0098]

[0099] in, represents the fused feature representation of node v at layer l, It is a set that contains the feature representations of node v in all L layers of OrderedGNN. Represents the feature representation of node v at the i-th layer.

[0100] Linformer() represents the operation of the Linformer model. Linformer is an improved self-attention mechanism for efficiently processing and fusing multi-scale features.

[0101] It should be understood that if Figure 4 and Figure 5 As shown in the figure, the Linformer model is used to fuse the node representations of different levels of OrderedGNN to extract multi-scale structural features.

[0102] Furthermore, the Linformer module fuses the structured representations of the nodes to obtain structural features, including:

[0103] First, the node embedding matrix extracted by Ordered GNN is transposed and used as the input X of Linformer. Query (Q), Key (K) and Value (V) are generated through linear projection. This process can be expressed as:

[0104] K=XW K ; Q = XW Q ; V = XW V ;

[0105] Where X is the embedded representation of the input sequence, W K , W Q and W V is a learnable weight matrix. After the first linear transformation, K and V are respectively combined with a d m ×d k The matrix of is multiplied to obtain the reduced-dimensional K and V; the original n-dimensional space is projected into a k-dimensional space, which greatly reduces the complexity of subsequent calculations.

[0106] Use the reduced K and V to perform a scaled dot product attention calculation with the original dimension Q to get the weight of each value:

[0107]

[0108] Among them, d k is the dimension of the key vector.

[0109] Finally, through weighted summation, the fusion representation of each node is obtained in Integrate the structural information from multiple layers of OrderedGNN to fully characterize the structural environment of the node. f is the fusion feature dimension.

[0110] OrderedGNN can capture the topological structure information of network traffic, but it is difficult to model the dynamically evolving temporal dependencies. To this end, the present invention introduces GRU as a temporal domain encoding module.

[0111] Furthermore, the GRU extracts features from the network traffic to be detected to obtain time series features; including:

[0112] First, sort the network traffic by timestamp to build time series data in, is the feature vector of all hosts at time step t.

[0113] Then, the gated recurrent unit GRU is used to encode the time series data S:

[0114] r t =σ(W r s t +U r h t-1 +b r )

[0115] z t =σ(W z s t +U z h t-1 +b z )

[0116]

[0117] Among them, r t and z t They are the reset gate and the update gate, which control the previous hidden state h t-1 selective memory and forgetting, is a new candidate hidden state, through the current input s t The final new state h is calculated by linear interpolation of the previous state. tUpdated via gated method.

[0118] Through T time steps of GRU encoding, we get the hidden state sequence Take the last hidden state h T As a time series feature vector, denoted as d t The temporal feature dimension is implicit in h T What is shown in is the global temporal evolution pattern of network behavior.

[0119] It should be understood that the gated recurrent unit GRU is used to encode network traffic from the time series dimension, capture the dynamically evolving time series pattern, and extract the network traffic time series characteristics.

[0120] Furthermore, the feature fusion module fuses the structural features and the temporal features to obtain fused features, including:

[0121] The structural feature h S and the time series characteristics h T Cascade to form the final fusion feature vector

[0122]

[0123] in Represents a vector concatenation operation.

[0124] Fusion feature vector h F It contains network traffic structure feature information and timing information, and has the ability to fully understand the behavior of botnets.

[0125] The structural features and temporal features extracted by OrderedGNN and GRU are fused and input into the classifier for botnet detection.

[0126] Furthermore, the classifier classifies the fused features to obtain a botnet detection result, and the classifier includes: a fully connected layer and a softmax activation function layer connected in sequence.

[0127] Use the fully connected layer and the activation function layer softmax to h F To classify:

[0128]

[0129] Among them, W f and b f are learnable weight and bias parameters;

[0130] The training goal is to minimize the cross entropy loss:

[0131]

[0132] Among them, λ is the regularization coefficient and θ is all the trainable parameters of the model.

[0133] The present invention uses the Adam optimizer for end-to-end training.

[0134] Taking the public data set ISCX-Bot-2014 as an example, a specific implementation process of the method of the present invention is described:

[0135] (21) Use the CICFlowMeter tool to extract 83 statistical features from the raw network traffic data.

[0136] (22) Using information gain and recursive feature elimination algorithm, 20 optimal features are selected from 83 features. The results are as follows: Figure 3 As shown, a 20-dimensional host feature vector is constructed.

[0137] (23) The network traffic data is constructed into an undirected graph G = (V, E, F), where V is the node set corresponding to all IP addresses, E is the edge set representing the IP communication relationship, and F contains a 20-dimensional host feature vector for each node;

[0138] (24) Input graph G to the 4-layer OrderedGNN to extract structural features. The relevant parameters are set as follows:

[0139] The node embedding dimension is 64, the message aggregation function AGGREGATE uses degree-based normalized mean pooling, and uses Linformer to fuse OrderedGNN4-layer node representation to obtain multi-scale structural features.

[0140] (25) Sort the network traffic by timestamp to construct time series data, which is input into a 3-layer GRU for time series modeling with a hidden layer dimension of 128.

[0141] (26) The OrderedGNN structural features and the GRU temporal features are concatenated to form the final fused feature vector, which is then input into two fully connected layers and classified with softmax.

[0142] (27) On the ISCX-Bot-2014 test set, it achieved a classification accuracy of 98.78% and an F1 score of 98.72%, outperforming other mainstream methods.

[0143] Embodiment 2

[0144] This embodiment provides a botnet detection system based on feature selection and feature fusion, including:

[0145] The acquisition module is configured to: acquire the network traffic to be detected, extract M statistical features from the network traffic to be detected; screen the M statistical features to select N optimal features; construct a host feature vector based on the N optimal features; and construct a triple list of the network traffic to be detected based on the host feature vector;

[0146] A graph structure building module, which is configured to: build a graph structure of the network traffic to be detected based on a triple list of the network traffic;

[0147] A detection module is configured to: input the network traffic to be detected and the graph structure of the network traffic to be detected into the trained botnet detection model to obtain a botnet detection result;

[0148] The trained botnet detection model includes: Ordered GNN, Linformer module, GRU, feature fusion module and classifier; the Ordered GNN extracts the structured representation of nodes from the graph structure of the network traffic to be detected, the Linformer module fuses the structured representation of the nodes to obtain structural features; the GRU extracts features of the network traffic to be detected to obtain time series features; the feature fusion module fuses the structural features and the time series features to obtain fused features; the classifier classifies the fused features to obtain botnet detection results.

[0149] It should be noted that the acquisition module, graph structure construction module and detection module described above correspond to steps S101 to S103 in Embodiment 1, and the examples and application scenarios implemented by the modules and corresponding steps are the same, but are not limited to the contents disclosed in Embodiment 1 described above. It should be noted that the modules described above as part of the system can be executed in a computer system such as a set of computer executable instructions.

[0150] The description of each embodiment in the above embodiments has different emphases. For parts not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0151] The proposed system can be implemented in other ways. For example, the system embodiment described above is only illustrative, and the division of the modules is only a logical function division. In actual implementation, there may be other division methods, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed.

[0152] Embodiment 3

[0153] This embodiment also provides an electronic device, including: one or more processors, one or more memories, and one or more computer programs; wherein the processor is connected to the memory, and the one or more computer programs are stored in the memory. When the electronic device is running, the processor executes the one or more computer programs stored in the memory so that the electronic device executes the method described in the above embodiment one.

[0154] It should be understood that in this embodiment, the processor may be a central processing unit CPU, and the processor may also be other general-purpose processors, digital signal processors DSP, application-specific integrated circuits ASIC, off-the-shelf programmable gate arrays FPGA or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0155] The memory may include a read-only memory and a random access memory, and provide instructions and data to the processor. A portion of the memory may also include a non-volatile random access memory. For example, the memory may also store information about the device type. In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software.

[0156] The method in the first embodiment can be directly embodied as a hardware processor, or a combination of hardware and software modules in the processor. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware. To avoid repetition, it will not be described in detail here.

[0157] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with this embodiment can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0158] Embodiment 4: This embodiment further provides a computer-readable storage medium for storing computer instructions. When the computer instructions are executed by a processor, the method described in Embodiment 1 is completed.

[0159] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A botnet detection method based on feature selection and feature fusion, characterized by: include: Obtain the network traffic to be detected, and extract M statistical features from the network traffic to be detected; Screen M statistical features and select N optimal features; Based on the N optimal features, a host feature vector is constructed; based on the host feature vector, a triple list of network traffic to be detected is constructed; Based on the triple list of network traffic, a graph structure of the network traffic to be detected is constructed; Inputting the network traffic to be detected and the graph structure of the network traffic to be detected into the trained botnet detection model to obtain the botnet detection result; The trained botnet detection model includes: Ordered GNN, Linformer module, GRU, feature fusion module and classifier; the Ordered GNN extracts the structured representation of nodes from the graph structure of the network traffic to be detected, the Linformer module fuses the structured representation of the nodes to obtain structural features; the GRU extracts features of the network traffic to be detected to obtain time series features; the feature fusion module fuses the structural features and the time series features to obtain fused features; the classifier classifies the fused features to obtain botnet detection results.

2. The botnet detection method based on feature selection and feature fusion as claimed in claim 1, characterized in that: Screen the M statistical features and select the N best features, including: (11) Calculate the mutual information score between each statistical feature and the target variable; (12) Based on the mutual information score, using a recursive feature elimination algorithm (RFE), N optimal features are selected from the M statistical features; Calculate the mutual information score between each statistical feature and the target variable, including: Among them, I(X;Y) represents the mutual information score between feature X and target variable Y, p(x,y) is the joint probability distribution of X and Y, p(x) is the marginal probability distribution of X, p(y) is the marginal probability distribution of Y, x represents the value of feature X, y represents the value of target variable Y; the value of the target variable is 0 or 1, 0 represents the network is a normal network, and 1 represents the network is a botnet.

3. The botnet detection method based on feature selection and feature fusion as claimed in claim 2, characterized in that: Based on the mutual information score, the recursive feature elimination algorithm RFE is used to select N optimal features from M statistical features, including: (12-1): Calculate the mutual information scores of all M features and the target variable; (12-2): Sort the features in descending order according to the mutual information score; (12-3): Select the K features with the highest mutual information scores to train a random forest classifier model. During training, the input value of the random forest classifier is the feature matrix X composed of the first K features, and the output value of the random forest classifier is the target variable Y. When the training reaches the set number of times, stop the training and obtain the trained random forest classifier. (12-4): Calculate the importance score of each feature in the random forest classifier model. For a feature j in the random forest, the calculation formula for the importance score I(n,j) is as follows: I(n,j)=w n ·(Gini(n)-p L ·Gini(n L )-p R ·Gini(n R )); Among them, w n is the sample weight of node n, Gini(n) is the Gini impurity of node n, p L and p R are the sample ratios of the left child node and the right child node, n L and n R They are the left child node and the right child node respectively; (12-5): Remove the feature with the lowest importance score; (12-6): Repeat steps (12-3)-(12-5), removing one feature at a time, until N features remain; (12-7): Return the last remaining N features as the optimal feature subset.

4. The botnet detection method based on feature selection and feature fusion as claimed in claim 1, characterized in that: Based on the triple list of network traffic, a graph structure of the network traffic to be detected is constructed, including: The IP address of each host is taken as a node in the graph structure. Whether there is a communication relationship between the host and other hosts is determined to determine whether there are interconnected edges between the nodes. If there is a communication relationship, there are interconnected edges between the corresponding nodes. If there is no communication relationship, there are no interconnected edges between the corresponding nodes.

5. The botnet detection method based on feature selection and feature fusion as claimed in claim 1, characterized in that: The trained botnet detection model includes: Ordered GNN, Linformer module, GRU, feature fusion module and classifier; The input end of the Ordered GNN is used to input the graph structure of the network traffic to be detected. The output end of the Ordered GNN outputs the structured representation of the node. The output end of the Ordered GNN is connected to the input end of the Linformer module. The output end of the Linformer module outputs the structural features. The output end of the Linformer module and the output end of the GRU are both connected to the input end of the feature fusion module. The output end of the feature fusion module is connected to the input end of the classifier. The output end of the classifier outputs the botnet detection result.

6. The botnet detection method based on feature selection and feature fusion as claimed in claim 1, characterized in that: The GRU extracts features of the network traffic to be detected to obtain time series features, including: First, sort the network traffic by timestamp to build time series data in, is the feature vector of all hosts at time step t; Then, the gated recurrent unit GRU is used to encode the time series data S: r t =σ(W r s t +U r h t-1 +b r ) z t =σ(W z s t +U z h t-1 +b z ) Among them, r t and z t They are the reset gate and the update gate, which control the previous hidden state h t-1 selective memory and forgetting, is a new candidate hidden state, through the current input s t The final new state h is calculated by linear interpolation of the previous state. t Updated via gated approach; Through T time steps of GRU encoding, we get the hidden state sequence Take the last hidden state h T As a time series feature vector, denoted as d t The temporal feature dimension is implicit in h t What is shown in is the global temporal evolution pattern of network behavior.

7. The botnet detection method based on feature selection and feature fusion as claimed in claim 1, characterized in that: The feature fusion module fuses the structural feature and the temporal feature to obtain a fusion feature, including: S and the time series characteristics h T Cascade to form the final fusion feature vector in, Represents a vector concatenation operation; The classifier classifies the fusion features to obtain a botnet detection result. The classifier includes: a fully connected layer and a softmax activation function layer connected in sequence; using the fully connected layer and the activation function layer softmax to classify h F To classify: Among them, W f and b f are learnable weight and bias parameters; The training goal is to minimize the cross entropy loss: Among them, λ is the regularization coefficient and θ is all the trainable parameters of the model.

8. A botnet detection system based on feature selection and feature fusion, characterized by: include: An acquisition module is configured to: acquire network traffic to be detected, and extract M statistical features from the network traffic to be detected; Screening the M statistical features to select N optimal features; constructing a host feature vector based on the N optimal features; constructing a triple list of network traffic to be detected based on the host feature vector; A graph structure building module, which is configured to: build a graph structure of the network traffic to be detected based on a triple list of the network traffic; A detection module is configured to: input the network traffic to be detected and the graph structure of the network traffic to be detected into the trained botnet detection model to obtain a botnet detection result; The trained botnet detection model includes: Ordered GNN, Linformer module, GRU, feature fusion module and classifier; the Ordered GNN extracts the structured representation of nodes from the graph structure of the network traffic to be detected, the Linformer module fuses the structured representation of the nodes to obtain structural features; the GRU extracts features of the network traffic to be detected to obtain time series features; the feature fusion module fuses the structural features and the time series features to obtain fused features; the classifier classifies the fused features to obtain botnet detection results.

9. An electronic device, comprising: a memory for non-transitory storage of computer readable instructions; as well as a processor for executing the computer readable instructions, When the computer-readable instructions are executed by the processor, the method described in any one of claims 1 to 7 is executed.

10. A storage medium, characterized in that: The computer-readable instructions are non-transitory stored, wherein when the non-transitory computer-readable instructions are executed by a computer, the instructions of the method according to any one of claims 1 to 7 are executed.

Images