Abnormal communication behavior monitoring device and method based on space-time diagram neural network, terminal equipment and storage medium

Abstract

The invention relates to the technical field of network security, in particular to an abnormal communication behavior monitoring device and method based on a space-time diagram neural network, terminal equipment and a storage medium, and the method comprises the steps: removing invalid sessions from original IP session data, and building an access relation adjacency matrix between different communication entities in a network according to the IP sessions; historical communication behaviors between different communication entities in the network are comprehensively considered through the access relation adjacent matrix, and the normal access relation between the communication entities in the network at the next moment is predicted; and comparing the normal access relationship and the real access relationship between different communication entities in the predicted network, judging whether the access relationship is consistent with a historical access behavior or not and whether an exception exists or not, and displaying the access relationship and the historical access behavior in a graph form. The method not only can process large-scale network data, but also can adapt to the dynamic change of a network environment, and realizes real-time monitoring and intelligent identification of hidden network attack behaviors.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and is an abnormal communication behavior monitoring device, method, terminal equipment and storage medium based on a spatiotemporal graph neural network. Background Art

[0002] With the continuous deepening of global informatization, cyber attack methods are becoming increasingly covert and complex, bringing unprecedented challenges to network security.

[0003] Traditional monitoring methods based on rule matching are increasingly unable to cope with these highly concealed and ever-changing network threats due to their static and single characteristics. Attackers use advanced persistent threats (APTs) and zero-day vulnerabilities to quietly invade network systems, lurk and collect sensitive information without triggering traditional security alerts.

[0004] In this context, the analysis of abnormal communication behavior patterns generated in network attacks is particularly important. When attackers conduct activities such as data theft and command and control (C2) communications, they will inevitably leave abnormal traces in network traffic. These abnormal behaviors, if captured and analyzed in a timely manner, will become the key to discovering and defending against network attacks. However, due to the huge scale and high dynamics of network traffic, traditional monitoring methods have difficulty effectively identifying these subtle abnormal patterns.

[0005] Therefore, there is an urgent need for an abnormal communication behavior monitoring device, method, terminal equipment and storage medium based on spatiotemporal graph neural network to solve the above problems. Summary of the invention

[0006] The present invention provides an abnormal communication behavior monitoring device, method, terminal equipment and storage medium based on a spatiotemporal graph neural network, which overcomes the shortcomings of the above-mentioned prior art and can effectively solve the problem.

[0007] One of the technical solutions of the present invention is achieved by the following measures: an abnormal communication behavior monitoring device based on spatiotemporal graph neural network, including a data modeling module, a data prediction module, and a data comparison and display module;

[0008] The data modeling module is used to remove invalid sessions from the original IP session data and establish an access relationship adjacency matrix between different communication entities in the network based on the IP session;

[0009] Among them, the data prediction module is used to comprehensively consider the historical communication behaviors between different communication entities in the network through the access relationship adjacency matrix, and predict the normal access relationship between communication entities in the network at the next moment;

[0010] Among them, the data comparison and display module is used to compare the normal access relationship and the actual access relationship between different communication entities in the predicted network, determine whether the access relationship is consistent with the historical access behavior and whether there is anomaly, and display it in the form of a graph.

[0011] The following is a further optimization and / or improvement of one of the above-mentioned technical solutions:

[0012] The above-mentioned data modeling module may include a data cleaning submodule and a data modeling submodule. The data cleaning submodule is used to remove a large number of IP sessions generated by normal network protocol communications and sessions in the whitelist from the original IP session data; the data modeling submodule is used to model the session relationship between different communication entities in the IP in the form of a graph, and establish attribute vectors for different communication entities in the network based on their attribute information.

[0013] The above-mentioned data prediction module may include a GNN submodule and a GRU submodule. The GNN submodule is used to capture the communication relationship between different communication entities in the network at the same time, and the GRU submodule is used to further capture the communication relationship between communication entities at different historical times based on the GNN submodule.

[0014] The second technical solution of the present invention is achieved by the following measures: A method for monitoring abnormal communication behavior based on spatiotemporal graph neural network, comprising the following steps:

[0015] Step S1: Eliminate invalid sessions from the original IP session data, and establish an access relationship adjacency matrix between different communication entities in the network according to the IP sessions;

[0016] Step S2: comprehensively consider the historical communication behaviors between different communication entities in the network through the access relationship adjacency matrix, and predict the normal access relationship between the communication entities in the network at the next moment;

[0017] Step S3: Compare the predicted normal access relationship between different communication entities in the network with the actual access relationship, determine whether the access relationship is consistent with the historical access behavior and whether there is anomaly, and display it in the form of a graph.

[0018] The following is a further optimization and / or improvement of the second technical solution of the above invention:

[0019] The above step S1 may specifically include the following steps:

[0020] Step S11: reading the original IP session data, and removing a large number of IP sessions generated by normal network protocol communications from the original IP session data;

[0021] Step S12: Compare the whitelist database with the initially cleared IP session data, and if the IP session data exists in the whitelist, remove it;

[0022] Step S13: dividing the IP session data after preliminary cleaning into a number of groups at fixed time intervals based on the session establishment time;

[0023] Step S14: Model IP session data in a graphical form and establish an access relationship graph G t =(V,E t ), where V represents the communication entity in the network, E t Represents the adjacency matrix of IP session relations between communication entities in the network at time t;

[0024] Step S15: Retrieve relevant information to establish an attribute matrix X for the communication entity v (v∈V) in the network.

[0025] The above step S2 may specifically include the following steps:

[0026] Step S21: input the communication entity attribute matrix X into a layer of neural network to obtain the initial embedding representation H of each communication entity;

[0027] H=W i X+b i

[0028] Step S22: Input the initial embedding representation of the communication entity into the graph neural network of layer l, and embed the communication relationship between the communication entities at time t into the representation matrix H' of the communication entity t In which GNN can be any spatial graph convolutional network or general graph convolutional network;

[0029] H' t =GNN(V,E t ,H|θ)

[0030] In the formula, θ represents the learnable parameters of the GNN model;

[0031] Step S23: Input the communication entity embedding representation matrix at time t into the GRU network, and embed the communication relationship between communication entities at different times into the communication entity representation matrix H t middle;

[0032] H t =GRU(H' t ,H t-1 |θ)

[0033] In the formula, θ represents the learnable parameters of the GRU model;

[0034] Step S24: According to H t, predict the communication relationship E' between different communication entities in the network at time t+1 t+1 ,

[0035]

[0036] In the above step S2, the parameter θ needs to be trained using historical IP session data between communication entities in a network over a period of time before use. The specific training steps may be:

[0037] Step S201: call the data modeling module, divide the IP sessions into M groups with k as the time interval, and establish M (M = {1, 2, 3, ..., t, t+1, ...., l, l+1, ...., m}) access relationship adjacency matrices, where the first l graphs are used as training data sets and the following ml graphs are used as test sets;

[0038] Step S202: Take the access relationship adjacency matrix at time t and input it into the model to predict the communication relationship adjacency matrix E' at time t+1 t+1 :

[0039] H' t =GNN(V,E t ,H|θ)

[0040] H l,t =GRU(H' t ,H t-1 |θ)

[0041]

[0042] Step S203: The binary cross entropy loss function calculates the prediction results E' t+1 and real IP session relationship E t+1 The loss value between them is loss,

[0043]

[0044] Step S204: Calculate the gradient of the model parameters using the loss value loss as input, and use the Adam optimizer to optimize the parameters f of the GNN and GRU models. θ (W i , GNN θ , GRU θ ),

[0045] f θ '=Adam(loss,f θ )

[0046] In the formula, f represents the overall prediction model composed of GNN and GRU in the data prediction module;

[0047] Step S205: Use the optimized model f to predict the IP session relationship graph E' in the next two test data in turn l+1 , and then the prediction result E' l+1 and the real access relation E l+1 Compare and calculate the prediction accuracy of the model. If the accuracy is greater than the current optimal result, save the model parameters.

[0048] Step S206: Repeat the above steps, iterate k times, gradually optimize the model parameters, and obtain the parameter values ​​under the optimal state of the model.

[0049] The above step S3 may specifically include the following steps:

[0050] Step S31: Calculate E t+1 and E' t+1 The difference between

[0051] E t+1,Δ =|E t+1 -E' t+1 |

[0052] Step S32: According to the screening conditions, construct the communication relationship E between the communication entities to be eliminated C , from which E t+1,Δ Eliminate the communication relationships that do not meet the conditions and obtain the abnormal communication behavior representation matrix E at the last t+1 moment t+1,B ,

[0053] E t+1,B =|E t+1,Δ -E C |

[0054] Step S33: Visually display E in the form of a network topology diagram t+1,B If any false positives are found in the results, continue to adjust the screening conditions and return to step S32 to continue.

[0055] The third technical solution of the present invention is achieved through the following measures: a terminal device includes a memory and a processor, the memory stores a program that can be run on the processor, and the processor implements the above-mentioned abnormal communication behavior monitoring method based on spatiotemporal graph neural network when executing the program.

[0056] The fourth technical solution of the present invention is achieved through the following measures: a storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned abnormal communication behavior monitoring method based on spatiotemporal graph neural network.

[0057] The present invention removes invalid sessions from the original IP session data, and establishes an access relationship adjacency matrix between different communication entities in the network based on the IP session; comprehensively considers the historical communication behaviors between different communication entities in the network through the access relationship adjacency matrix, and predicts the normal access relationship between communication entities in the network at the next moment; compares the predicted normal access relationship between different communication entities in the network with the actual access relationship, determines whether the access relationship is consistent with the historical access behavior and whether there is anomaly, and displays it in the form of a graph. In the present invention, the spatiotemporal graph neural network can comprehensively consider the time series characteristics and spatial topological structure of network communication, and captures the abnormal communication mode generated during the network attack process by learning the temporal dependency and spatial association between communication entities. The present invention can not only process large-scale network data, but also adapt to the dynamic changes of the network environment, and realize real-time monitoring and intelligent identification of hidden network attack behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 It is a schematic diagram of the framework of an abnormal communication behavior monitoring device based on a spatiotemporal graph neural network in an embodiment of the present invention. DETAILED DESCRIPTION

[0059] The present invention is not limited by the following embodiments, and specific implementation methods can be determined based on the technical solution of the present invention and actual conditions.

[0060] The present invention will be further described below in conjunction with embodiments:

[0061] Embodiment 1: As attached Figure 1 As shown, the abnormal communication behavior monitoring device based on spatiotemporal graph neural network includes a data modeling module, a data prediction module, and a data comparison and display module;

[0062] The data modeling module is used to remove invalid sessions from the original IP session data and establish an access relationship adjacency matrix between different communication entities in the network based on the IP session;

[0063] Among them, the data prediction module is used to comprehensively consider the historical communication behaviors between different communication entities in the network through the access relationship adjacency matrix, and predict the normal access relationship between communication entities in the network at the next moment;

[0064] Among them, the data comparison and display module is used to compare the normal access relationship and the actual access relationship between different communication entities in the predicted network, determine whether the access relationship is consistent with the historical access behavior and whether there is anomaly, and display it in the form of a graph.

[0065] In this embodiment, the data modeling module includes a data cleaning submodule and a data modeling submodule. The data cleaning submodule is used to remove a large number of IP sessions generated by normal network protocol communications and sessions in the whitelist from the original IP session data; the data modeling submodule is used to model the session relationship between different communication entities in the IP in the form of a graph, and establish attribute vectors for different network communication entities according to their attribute information. When performing data modeling, first read the original IP session data, and remove a large number of IP sessions generated by normal network protocol communications from the original IP session data; compare the whitelist library with the IP session data after preliminary cleaning, and if the IP session data exists in the whitelist, remove it; divide the IP session data after preliminary cleaning into several groups at fixed time intervals according to the session establishment time; model the IP session data in the form of a graph, and establish an access relationship graph G. t =(V,E t ), where V represents the communication entity in the network, E t Represents the adjacency matrix of IP session relations between communication entities in the network at time t; retrieves relevant information to establish the attribute matrix X for the communication entity v (v∈V) in the network.

[0066] In this embodiment, the data prediction module includes a GNN submodule and a GRU submodule. The GNN submodule is used to capture the communication relationship between different communication entities in the network at the same time, and the GRU submodule is used to further capture the communication relationship between communication entities at different historical times based on the GNN submodule.

[0067] After capturing the normal historical communication relationship between communication entities, the data prediction module predicts the communication relationship at the next moment. First, the communication entity attribute matrix X is input into a layer of neural network to obtain the initial embedding representation H of each communication entity. Where H = W i X+b i ; Then the initial embedding representation of the communication entity is input into the graph neural network of layer l, and the communication relationship between the communication entities at time t is embedded into the representation matrix H' of the communication entity t In which GNN can be any spatial graph convolutional network or general graph convolutional network;

[0068] H' t =GNN(V,E t ,H|θ)

[0069] In the formula, θ represents the learnable parameters of the GNN model;

[0070] Then, the communication entity embedding representation matrix at time t is input into the GRU network, and the communication relationship between communication entities at different times is embedded into the communication entity representation matrix H t middle;

[0071] H t =GRU(H' t ,H t-1 |θ)

[0072] In the formula, θ represents the learnable parameters of the GRU model;

[0073] Finally, according to H t , predict the communication relationship E' between different communication entities in the network at time t+1 t+1 ,;

[0074]

[0075] In the data prediction module, both the GNN submodule and the GRU submodule involve some learnable parameters θ. Before use, they need to be trained using the historical IP conversation data between communication entities in the network over a certain period of time. First, the data modeling module of the model is called to divide the IP conversations into M groups with k as the time interval, and establish

[0076] M (M={1,2,3,...,t,t+1,....,l,l+1,....,m}) access relationship adjacency matrices, of which the first l graphs are used as training data sets, and the following ml graphs are used as test sets; take the access relationship adjacency matrix at time t and input it into the model to predict the communication relationship adjacency matrix E' at time t+1 t+1 :

[0077] H' t =GNN(V,E t ,H|θ)

[0078] H l,t =GRU(H' t ,H t-1 |θ)

[0079]

[0080] The binary cross entropy loss function calculates the prediction results E' t+1 and real IP session relationship E t+1 The loss value between them is loss;

[0081]

[0082] The loss value loss is used as input to calculate the gradient of the model parameters, and the Adam optimizer is used to optimize the parameters f of the GNN and GRU models. θ (W i , GNN θ , GRU θ );

[0083] f θ'=Adam(loss,f θ )

[0084] In the formula, f represents the overall prediction model composed of GNN and GRU in the data prediction module;

[0085] Use the optimized model f to predict the IP session relationship graph E' in the next two test data. l+1 , and then the prediction result E' l+1 and the real access relation E l+1 Compare and calculate the prediction accuracy of the model. If the accuracy is greater than the current optimal result, save the model parameters. Repeat the above steps, iterate k times, gradually optimize the model parameters, and obtain the parameter values ​​under the optimal state of the model.

[0086] In the data comparison and display module, the communication relationship E between the actual communication entities at time t+1 is compared. t+1 and the predicted communication relationship E' t+1 , mark the different communication relationships between the two, and then display them in the form of a network topology diagram. t+1 It is the communication relationship at time t+1 predicted by the model based on the historical communication relationship between communication entities in the network. Therefore, E' t+1 It can represent the normal communication relationship of the network at time t+1. If the real E t+1 There are a lot of E' t+1 Inconsistent communication relationships indicate that there are abnormalities in these communication relationships. However, in some cases, due to the launch of some new services and changes in old services, a large number of communication relationships inconsistent with the original mode may appear. Therefore, some filtering conditions are added to the display part of this module to quickly eliminate these normal communication behaviors. First, calculate E t+1 and E' t+1 Differences between

[0087] E t+1,Δ =|E t+1 -E' t+1 |

[0088] According to the screening conditions, the communication relationship E between the communication entities that need to be eliminated is constructed C , and then from E t+1,Δ Eliminate the communication relationships that do not meet the conditions and obtain the abnormal communication behavior representation matrix E at the last t+1 moment t+1,B ;

[0089] E t+1,B =|E t+1,Δ -E C |

[0090] Visualize E in the form of network topology diagramt+1,B If you find any false positives in the results, continue to adjust the filter conditions.

[0091] The abnormal communication behavior monitoring device based on the spatiotemporal graph neural network removes invalid sessions from the original IP session data, and establishes an access relationship adjacency matrix between different communication entities in the network according to the IP session; comprehensively considers the historical communication behavior between different communication entities in the network through the access relationship adjacency matrix, and predicts the normal access relationship between communication entities in the network at the next moment; compares the predicted normal access relationship between different communication entities in the network with the actual access relationship, and judges whether the access relationship is consistent with the historical access behavior and whether there is an abnormality, and displays it in the form of a graph. In this embodiment, the spatiotemporal graph neural network can comprehensively consider the time series characteristics and spatial topological structure of network communication, and capture the abnormal communication mode generated during the network attack process by learning the temporal dependence and spatial association between communication entities. The abnormal communication behavior monitoring device based on the spatiotemporal graph neural network can process large-scale network data, and can also adapt to the dynamic changes of the network environment, so as to realize real-time monitoring and intelligent identification of hidden network attack behaviors.

[0092] Embodiment 2: This embodiment provides a method for monitoring abnormal communication behavior based on a spatiotemporal graph neural network, comprising the following steps:

[0093] Step S1: Eliminate invalid sessions from the original IP session data, and establish an access relationship adjacency matrix between different communication entities in the network according to the IP sessions;

[0094] Step S2: comprehensively consider the historical communication behaviors between different communication entities in the network through the access relationship adjacency matrix, and predict the normal access relationship between the communication entities in the network at the next moment;

[0095] Step S3: Compare the predicted normal access relationship between different communication entities in the network with the actual access relationship, determine whether the access relationship is consistent with the historical access behavior and whether there is anomaly, and display it in the form of a graph.

[0096] In step S1, data cleaning and data modeling are required. Data cleaning is to remove a large number of IP sessions generated by normal network protocol communications and sessions in the whitelist from the original IP session data. Data modeling uses a graph to model the session relationship between different communication entities in the IP, and then establishes attribute vectors for different network communication entities based on their attribute information. In this embodiment, step S1 specifically includes the following steps:

[0097] Step S11: reading the original IP session data, and removing a large number of IP sessions generated by normal network protocol communications from the original IP session data;

[0098] Step S12: Compare the whitelist database with the initially cleared IP session data, and if the IP session data exists in the whitelist, remove it;

[0099] Step S13: dividing the IP session data after preliminary cleaning into a number of groups at fixed time intervals based on the session establishment time;

[0100] Step S14: Model IP session data in a graphical form and establish an access relationship graph G t =(V,E t ), where V represents the communication entity in the network, E t Represents the adjacency matrix of IP session relations between communication entities in the network at time t;

[0101] Step S15: Retrieve relevant information to establish an attribute matrix X for the communication entity v (v∈V) in the network.

[0102] In step S2, the GNN model and the GRU model need to be used; the GNN model captures the communication relationship between different communication entities in the network at the same time, and the GRU model further captures the communication relationship between communication entities at different historical times based on the GNN model. After capturing the normal historical communication relationship between communication entities, the communication relationship at the next moment is predicted. In this embodiment, step S2 specifically includes the following steps:

[0103] Step S21: input the communication entity attribute matrix X into a layer of neural network to obtain the initial embedding representation H of each communication entity;

[0104] H=W i X+b i

[0105] Step S22: Input the initial embedding representation of the communication entity into the graph neural network of layer l, and embed the communication relationship between the communication entities at time t into the representation matrix H' of the communication entity t In which GNN can be any spatial graph convolutional network or general graph convolutional network;

[0106] H' t =GNN(V,E t ,H|θ)

[0107] In the formula, θ represents the learnable parameters of the GNN model;

[0108] Step S23: Input the communication entity embedding representation matrix at time t into the GRU network, and embed the communication relationship between communication entities at different times into the communication entity representation matrix H t middle;

[0109] H t=GRU(H' t ,H t-1 |θ)

[0110] In the formula, θ represents the learnable parameters of the GRU model;

[0111] Step S24: According to H t , predict the communication relationship E' between different communication entities in the network at time t+1 t+1 ,

[0112]

[0113] It is worth noting that both the GNN model and the GRU model involve some learnable parameters θ. In this embodiment, in step S2, the parameter θ needs to be trained using historical IP session data between communication entities in the network over a period of time before use. The specific training steps are:

[0114] Step S201: call the data modeling module, divide the IP sessions into M groups with k as the time interval, and establish M (M = {1, 2, 3, ..., t, t+1, ...., l, l+1, ...., m}) access relationship adjacency matrices, where the first l graphs are used as training data sets and the following ml graphs are used as test sets;

[0115] Step S202: Take the access relationship adjacency matrix at time t and input it into the model to predict the communication relationship adjacency matrix E' at time t+1 t+1 :

[0116] H' t =GNN(V,E t ,H|θ)

[0117] H l,t =GRU(H' t ,H t-1 |θ)

[0118]

[0119] Step S203: The binary cross entropy loss function calculates the prediction results E' t+1 and real IP session relationship E t+1 The loss value between them is loss,

[0120]

[0121] Step S204: Calculate the gradient of the model parameters using the loss value loss as input, and use the Adam optimizer to optimize the parameters f of the GNN and GRU models. θ (W i , GNN θ , GRUθ ),

[0122] f θ '=Adam(loss,f θ )

[0123] In the formula, f represents the overall prediction model composed of GNN and GRU in the data prediction module;

[0124] Step S205: Use the optimized model f to predict the IP session relationship graph E' in the next two test data in turn l+1 , and then the prediction result E' l+1 and the real access relation E l+1 Compare and calculate the prediction accuracy of the model. If the accuracy is greater than the current optimal result, save the model parameters.

[0125] Step S206: Repeat the above steps, iterate k times, gradually optimize the model parameters, and obtain the parameter values ​​under the optimal state of the model.

[0126] In step S3, the actual communication relationship E between the communication entities at time t+1 is compared. t+1 and the predicted communication relationship E' t+1 , mark out the different communication relationships between the two, and then display them in the form of a network topology diagram. t+1 It is the communication relationship at time t+1 predicted by the model based on the historical communication relationship between communication entities in the network. Therefore, E' t+1 It can represent the normal communication relationship of the network at time t+1. If the real E t+1 There are a lot of E' t+1 Inconsistent communication relationships indicate that there are abnormalities in these communication relationships. However, in some cases, due to the launch of some new services and changes in old services, a large number of communication relationships that are inconsistent with the original mode may appear. Therefore, some screening conditions are added to the display part of this module to quickly eliminate these normal communication behaviors through the screening conditions. In this embodiment, step S3 specifically includes the following steps:

[0127] Step S31: Calculate E t+1 and E' t+1 The difference between

[0128] E t+1,Δ =|E t+1 -E' t+1 |

[0129] Step S32: According to the screening conditions, construct the communication relationship E between the communication entities to be eliminated C , from which E t+1,ΔEliminate the communication relationships that do not meet the conditions and obtain the abnormal communication behavior representation matrix E at the last t+1 moment t+1,B ,

[0130] E t+1,B =|E t+1,Δ -E C |

[0131] Step S33: Visually display E in the form of a network topology diagram t+1,B If any false positives are found in the results, continue to adjust the screening conditions and return to step S32 to continue.

[0132] The abnormal communication behavior monitoring method based on the spatiotemporal graph neural network removes invalid sessions from the original IP session data, and establishes an access relationship adjacency matrix between different communication entities in the network according to the IP session; comprehensively considers the historical communication behavior between different communication entities in the network through the access relationship adjacency matrix, and predicts the normal access relationship between communication entities in the network at the next moment; compares the predicted normal access relationship between different communication entities in the network with the actual access relationship, and judges whether the access relationship is consistent with the historical access behavior and whether there is an abnormality, and displays it in the form of a graph. In this embodiment, the spatiotemporal graph neural network can comprehensively consider the time series characteristics and spatial topological structure of network communication, and capture the abnormal communication mode generated during the network attack process by learning the temporal dependence and spatial association between communication entities. The abnormal communication behavior monitoring method based on the spatiotemporal graph neural network can process large-scale network data, and can also adapt to the dynamic changes of the network environment, so as to realize real-time monitoring and intelligent identification of hidden network attack behaviors.

[0133] Embodiment 3: This embodiment provides a terminal device, which includes a memory, a processor, a communication interface and a communication bus. The memory stores a program that can be run on the processor. When the processor executes the program, the abnormal communication behavior monitoring method based on the spatiotemporal graph neural network in the above embodiment is implemented.

[0134] The processor may be a central processing unit, or other general-purpose processors, digital signal processors, application-specific integrated circuits, field programmable gate arrays or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0135] The memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer executable programs and units, such as the corresponding program units in the above method embodiments of the present invention. The processor executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions and modules stored in the memory, thereby realizing the abnormal communication behavior monitoring method based on spatiotemporal graph neural network in the above embodiment.

[0136] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required by at least one function; the data storage area may store data created by the processor, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. The memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. One or more programs are stored in the memory, and when executed by the processor, the abnormal communication behavior monitoring method based on the spatiotemporal graph neural network in the above embodiment is executed.

[0137] Embodiment 4: This embodiment provides a storage medium for computer-readable storage, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the abnormal communication behavior monitoring method based on spatiotemporal graph neural network as in the above embodiment.

[0138] The storage medium may be an internal storage unit of the terminal device, such as a hard disk or memory of the terminal device. The storage medium may also be an external storage device of the terminal device, such as a plug-in hard disk, smart memory card, secure digital card, flash memory card, etc. equipped on the terminal device.

[0139] The above technical features constitute the embodiments of the present invention, which have strong adaptability and implementation effect. Non-essential technical features can be added or reduced according to actual needs to meet the requirements of different situations.

Claims

1. An abnormal communication behavior monitoring device based on spatiotemporal graph neural network, characterized in that Including data modeling module, data prediction module, data comparison and display module; The data modeling module is used to remove invalid sessions from the original IP session data and establish an access relationship adjacency matrix between different communication entities in the network based on the IP session; Among them, the data prediction module is used to comprehensively consider the historical communication behaviors between different communication entities in the network through the access relationship adjacency matrix, and predict the normal access relationship between communication entities in the network at the next moment; Among them, the data comparison and display module is used to compare the normal access relationship and the actual access relationship between different communication entities in the predicted network, determine whether the access relationship is consistent with the historical access behavior and whether there is anomaly, and display it in the form of a graph.

2. The abnormal communication behavior monitoring device based on spatiotemporal graph neural network according to claim 1 is characterized in that The data modeling module includes a data cleaning submodule and a data modeling submodule. The data cleaning submodule is used to remove a large number of IP sessions generated by normal network protocol communications and sessions in the whitelist from the original IP session data. The data modeling submodule is used to model the conversation relationship between different communication entities in IP in the form of a graph, and to establish attribute vectors for different communication entities in the network according to their attribute information.

3. The abnormal communication behavior monitoring device based on spatiotemporal graph neural network according to claim 1 or 2 is characterized in that The data prediction module includes a GNN submodule and a GRU submodule. The GNN submodule is used to capture the communication relationship between different communication entities in the network at the same time. The GRU submodule is used to further capture the communication relationship between communication entities at different historical moments based on the GNN submodule.

4. A method for monitoring abnormal communication behavior based on spatiotemporal graph neural network, characterized in that The following steps are involved: Step S1: Eliminate invalid sessions from the original IP session data, and establish an access relationship adjacency matrix between different communication entities in the network according to the IP sessions; Step S2: comprehensively consider the historical communication behaviors between different communication entities in the network through the access relationship adjacency matrix, and predict the normal access relationship between the communication entities in the network at the next moment; Step S3: Compare the predicted normal access relationship between different communication entities in the network with the actual access relationship, determine whether the access relationship is consistent with the historical access behavior and whether there is anomaly, and display it in the form of a graph.

5. The abnormal communication behavior monitoring method based on spatiotemporal graph neural network according to claim 4 is characterized in that Step S1 specifically includes the following steps: Step S11: reading the original IP session data, and removing a large number of IP sessions generated by normal network protocol communications from the original IP session data; Step S12: Compare the whitelist database with the initially cleared IP session data, and if the IP session data exists in the whitelist, remove it; Step S13: dividing the IP session data after preliminary cleaning into a number of groups at fixed time intervals based on the session establishment time; Step S14: Model IP session data in a graphical form and establish an access relationship graph G t =(V,E t ), where V represents the communication entity in the network, E t Represents the adjacency matrix of IP session relations between communication entities in the network at time t; Step S15: Retrieve relevant information to establish an attribute matrix X for the communication entity v (v∈V) in the network.

6. The abnormal communication behavior monitoring method based on spatiotemporal graph neural network according to claim 5 is characterized in that Step S2 specifically includes the following steps: Step S21: input the communication entity attribute matrix X into a layer of neural network to obtain the initial embedding representation H of each communication entity; H=W i X+b i Step S22: Input the initial embedding representation of the communication entity into the graph neural network of layer l, and embed the communication relationship between the communication entities at time t into the representation matrix H' of the communication entity t In which GNN can be any spatial graph convolutional network or general graph convolutional network; The t =GNN(V,E t ,H|θ) In the formula, θ represents the learnable parameters of the GNN model; Step S23: Input the communication entity embedding representation matrix at time t into the GRU network, and embed the communication relationship between communication entities at different times into the communication entity representation matrix H t middle; H t =GRU(H' t ,H t-1 |θ) In the formula, θ represents the learnable parameters of the GRU model; Step S24: According to H t , predict the communication relationship E' between different communication entities in the network at time t+1 t+1 , 7. The abnormal communication behavior monitoring method based on spatiotemporal graph neural network according to claim 6 is characterized in that In step S2, the parameter θ needs to be trained using historical IP session data between communication entities in a network over a period of time before use. The specific training steps are: Step S201: call the data modeling module, divide the IP sessions into M groups with k as the time interval, and establish M (M = {1, 2, 3, ..., t, t+1, ...., l, l+1, ...., m}) access relationship adjacency matrices, where the first l graphs are used as training data sets and the following ml graphs are used as test sets; Step S202: Take the access relationship adjacency matrix at time t and input it into the model to predict the communication relationship adjacency matrix E' at time t+1 t+1 : The t =GNN(V,E t ,H|θ) H l,t =GRU(H' t ,H t-1 |θ) Step S203: The binary cross entropy loss function calculates the prediction results E' t+1 and real IP session relationship E t+1 The loss value between them is loss, Step S204: Calculate the gradient of the model parameters using the loss value loss as input, and use the Adam optimizer to optimize the parameters f of the GNN and GRU models. θ (W i , GNN θ , GRU θ ), f θ ’=Adam(loss,f θ ) In the formula, f represents the overall prediction model composed of GNN and GRU in the data prediction module; Step S205: Use the optimized model f to predict the IP session relationship graph E' in the next two test data in turn l+1 , and then the prediction result E' l+1 and the real access relation E l+1 Compare and calculate the prediction accuracy of the model. If the accuracy is greater than the current optimal result, save the model parameters. Step S206: Repeat the above steps, iterate k times, gradually optimize the model parameters, and obtain the parameter values ​​under the optimal state of the model.

8. The abnormal communication behavior monitoring method based on spatiotemporal graph neural network according to claim 4, 5, 6 or 7, characterized in that Step S3 specifically includes the following steps: Step S31: Calculate E t+1 and E' t+1 The difference between AND t+1,Δ =|And t+1 -AND' t+1 | Step S32: According to the screening conditions, construct the communication relationship E between the communication entities to be eliminated C , from which E t+1,Δ Eliminate the communication relationships that do not meet the conditions and obtain the abnormal communication behavior representation matrix E at the last t+1 moment t+1,B , AND t+1,B =|And t+1,Δ -AND C | Step S33: Visually display E in the form of a network topology diagram t+1,B If any false positives are found in the results, continue to adjust the screening conditions and return to step S32 to continue.

9. A terminal device, comprising a memory and a processor, wherein the memory stores a program that can be run on the processor, characterized in that: When the processor executes the program, it implements the abnormal communication behavior monitoring method based on the spatiotemporal graph neural network as described in any one of claims 4 to 8.

10. A storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the abnormal communication behavior monitoring method based on spatiotemporal graph neural network as described in any one of claims 4 to 8.

Images