A malicious traffic detection method based on dynamic graph neural network

Abstract

The present invention relates to a malicious traffic detection method based on a dynamic graph neural network, which solves the defect that it is difficult to effectively detect malicious traffic compared with the prior art. The present invention includes the following steps: acquiring traffic data and constructing a heterogeneous graph; setting the representation of dynamic nodes; using dynamic graph representation learning to capture cluster representations that evolve over time; and detecting malicious traffic. The present invention utilizes the concept of superflow, a collection of network flows that exhibit the same behavior, and simultaneously creates a superflow-host association graph with a timestamp. Based on a dynamic graph representation learning framework, the dynamic node representation of hosts and superflows is learned to simulate the continuous changes in network traffic behavior, thereby realizing the detection of malicious traffic.

Description

Technical Field

[0001] The present invention relates to the field of cyberspace security and artificial intelligence technology, and specifically to a malicious traffic detection method based on a dynamic graph neural network. Background Art

[0002] With the rapid development of the Internet, malware such as viruses, worms, Trojans, and ransomware have become the main threats to network security. These malware can not only steal sensitive data, but also damage computer systems and networks. At the same time, with the development of technologies such as the Internet of Things (IoT) and cloud services, network attacks have developed to have covert communication and intelligent control functions, making it increasingly difficult to detect attack hosts.

[0003] Existing malicious traffic detection technologies include signature matching, anomaly detection, behavioral analysis, machine learning, and deep learning. Signature matching is the most traditional detection method, which identifies attacks by matching network traffic with known malicious signatures. Anomaly detection is based on statistical models or machine learning algorithms to detect traffic patterns that are significantly different from normal behavior. Behavioral analysis focuses on analyzing the behavioral characteristics of network traffic, such as connection frequency, packet size, and protocol type, to identify suspicious activities. Machine learning and deep learning technologies use algorithms to process and analyze large amounts of network traffic data to identify complex attack patterns. Malicious traffic detection requires effective monitoring of complex network traffic. However, the use of a large number of evasion techniques seriously hinders effective detection. Specifically, during the communication stage of robots, attackers often deploy encryption protocols (such as TLS) to hide malicious data. By 2021, more than 46% of network attack communications use encryption technology. The widespread use of encryption technology has greatly affected the effectiveness of malicious traffic detection that relies on deep packet inspection (DPI).

[0004] The dynamic nature of malicious attack attributes complicates manual feature selection, and encryption and traffic jamming strategies further challenge these methods, affecting detection accuracy. Another strategy is to build a correlation graph from malicious attack network communications and then analyze it for community detection. However, while this approach enhances detection capabilities, it still faces challenges related to indicator and threshold selection, and network attacks can also adaptively adjust specific indicators to evade detection.

[0005] Therefore, how to design an accurate and effective malicious traffic detection method has become a technical problem that needs to be solved urgently. Summary of the invention

[0006] The purpose of the present invention is to solve the defect that it is difficult to effectively detect malicious traffic in the prior art, and to provide a malicious traffic detection method based on a dynamic graph neural network to solve the above problem.

[0007] In order to achieve the above object, the technical solution of the present invention is as follows:

[0008] A malicious traffic detection method based on dynamic graph neural network includes the following steps:

[0009] Obtaining traffic data and building a heterogeneous graph: Obtain traffic data of hosts and super flows, divide the flows into different super flows according to the quadruple of network flows, and design a heterogeneous graph;

[0010] Perform dynamic node representation setting: monitor new network flows. As new network flows appear, their arrival times are encoded and then fused with the representations of related hosts and super flows to update the node information representation.

[0011] Use dynamic graph representation learning to capture cluster representations that evolve over time: as network flows emerge, the relevance of each member of the cluster is calculated and then used to update the cluster representation of the entire cluster and the information representation of the included members;

[0012] Detect malicious traffic: Design a network classification module to classify super flows to identify malicious attack behavior patterns and mark the corresponding hosts as attack host nodes.

[0013] The acquisition of traffic data and construction of a heterogeneous graph include the following steps:

[0014] Get the traffic data of the host and superflow, and use [ipdst, abup, abdown, proto] to divide different superflows, where ipdst is the target IP address, abup is the average number of bytes per packet of the upstream traffic of the network flow, abdown is the average number of bytes per packet of the downstream traffic of the network flow, and proto is the protocol type;

[0015] Designing heterogeneous graphs To represent the association between host network flows and superflow nodes, let H represent the set of hosts, each host is uniquely identified by its IP address, let S represent the set of superflows, each superflow is initialized by the characteristics of the first flow connected to it, containing the four-tuple information extracted from the flow, let E represent the set of edges between host network flows and superflow nodes,

[0016] definition ,

[0017] in, and represents all connections between the host and the superflow, where and It is a variable parameter;

[0018] If from the host flow In a specific time window Time within With Super Flow , then the edge connecting these two nodes Add to .

[0019] The step of setting the representation of the dynamic node comprises the following steps:

[0020] Use vectorized representation to represent new network flow associations. Network flows occurring at different times indicate different network activity patterns.

[0021] Get a new network stream When an association arrives, calculate the time interval between the network flow and the last network flow in the same superflow , defined as ,

[0022] in, is the timestamp of the current stream, is the timestamp of the previous stream,

[0023] , Timestamp by encoding, which captures temporal features derived from time intervals;

[0024] For time interval Encode and generate time code , the formula is as follows:

[0025] ,

[0026] in, and is a trainable parameter, () is the cosine function;

[0027] Get time code After that, process the network flow association to each host and super flow Generate respective information representation and , used to capture the temporal correlation characteristics of hosts and super flows,

[0028] Information Representation The formula is as follows:

[0029] ,

[0030] in, Represents a super flow exist Time information representation, represents the join operation, implemented as a merge vector, and Representation Node and exist The previous memory state, and is a trainable parameter, is the activation function,

[0031] Calculated in the same way, memory is used to retain long-term patterns of traffic behavior;

[0032] After obtaining the information representation, GRU is used to combine the memory of the relevant nodes with the information representation to update the node memory representation;

[0033] The dynamic memory of the host and superflow is initialized to zero vectors and learned from the global host-superflow association behavior. The formula for this update is as follows:

[0034] ,

[0035] in, Represents a super flow exist The memory state of the moment, Represents a super flow exist The memory state of the previous moment, Represents a super flow exist The information at each moment is represented by GRU, which represents the gated recurrent unit. The same method is used to update the host. Memory status .

[0036] The method of using dynamic graph representation learning to capture cluster representations that evolve over time includes the following steps:

[0037] When new network flow associations arrive, the graph structure and node representation change, treating each participating superflow node as a cluster center and its neighbors as cluster members;

[0038] For super flow nodes ,Will Treat as a cluster center, for ,use express The set of cluster members in Neighborhood composition;

[0039] In order to measure the degree of association between hosts and clusters, an attention mechanism is used to simulate the member association strength, which is expressed as ,

[0040] use The memory of the members in is the potential cluster Create a representative query vector as follows:

[0041] ,

[0042] in, Indicated in At all times The maximum value of the memory state among the cluster members centered is Represents a super flow exist The memory state of the moment, Representation and Clustering Each member of At the moment associated memory states;

[0043] Use the attention mechanism to calculate the relevance of members , as shown below:

[0044] ,

[0045] ,

[0046] in Indicates members With Super Flow exist The member association degree that is not normalized at the moment, and represents the learnable parameters, Indicated in Time The maximum value of the memory state among the cluster members centered is Indicates members exist Memory status at the moment represents the activation function, Representation Node In its cluster Internal The member relevance at the moment;

[0047] Aggregate clusters based on calculated membership strengths The memory of the internal members is represented by the computing cluster , given by the following formula:

[0048] ,

[0049] in, Represents a cluster At the moment The cluster representation is Representation Node In its cluster Internal The member association at the moment, Indicates members exist The memory state at the moment;

[0050] Hosts connected to the same superflow cluster exhibit similar network behaviors and are more likely to be associated with similar superflow clusters. After obtaining the cluster structure and capturing the cluster representation, messages are propagated throughout the cluster to spread the cluster effect of network behavior. Information representations are generated for directly connected nodes, and this new information is recursively propagated to other cluster members.

[0051] When new network flow When it arrives, its information representation is calculated based on the membership association of other cluster members, which is determined by the following formula:

[0052] ,

[0053] in, Represents a cluster Members of exist The information of the time is shown. Represents a cluster Members of exist The member association at the moment, express exist Information representation at the moment;

[0054] In computing cluster-based information representation back,

[0055] use Update the cluster The memory state of each node in ,This process allows the impact of new network flows to propagate and diffuse throughout the cluster.

[0056] The detection of malicious traffic includes the following steps:

[0057] Through detection to The super flow in the time period is used to identify malicious traffic, and the obtained super flow node representation is integrated with the cluster representation. The calculation formula is as follows:

[0058] ,

[0059] in, and is a trainable parameter, Represents a cluster exist The cluster representation of time, Represents a cluster exist The memory state at the moment;

[0060] The malicious host detection task is regarded as a classification problem, and the cross entropy function is used as the loss function, which is expressed as follows:

[0061] ,

[0062] in, is the number of training samples, L is the loss function, yes At the moment for The actual probability of yes At the moment for The predicted probability of

[0063] when When , it corresponds to the binary classification problem, and denote the actual label and the model prediction. Samples in to The probability of malicious host behavior in the time window is processed by the Sigmoid function to ensure that the value is between 0 and 1; Indicates that the sample is part of a malicious host behavior. Indicates no.

[0064] Beneficial Effects

[0065] Compared with the prior art, the malicious traffic detection method based on dynamic graph neural network of the present invention utilizes the concept of superflow to show a collection of network flows with the same behavior, and creates a superflow-host association graph with timestamp. Based on the dynamic graph representation learning framework, the dynamic node representation of hosts and superflows is learned to simulate the continuous changes in network traffic behavior, thereby realizing the detection of malicious traffic.

[0066] This paper introduces a dynamic graph representation learning framework and the concept of superflow to solve the problem of malicious traffic detection. The relationship between hosts and superflows is regarded as a time-related graph, and a dynamic node representation is developed to effectively capture the interconnection characteristics of large-scale network traffic. At the same time, a cluster-based dynamic information diffusion mechanism is proposed to aggregate superflow features. This mechanism dynamically clusters hosts with similar network traffic behaviors into superflow clusters and learns their respective information representations. The continuous-time dynamic graph is used to implement a detection method specifically for malicious traffic detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] Figure 1 is a method sequence diagram of the present invention;

[0068] Figure 2 The host-superflow dynamic diagram involved in the present invention;

[0069] Figure 3 This is a diagram of the dynamic representation learning architecture for malicious traffic detection using super flow involved in the present invention. DETAILED DESCRIPTION

[0070] In order to have a further understanding and recognition of the structural features and the effects achieved by the present invention, a preferred embodiment and accompanying drawings are used for detailed description as follows:

[0071] An efficient malicious traffic detection method and system architecture based on dynamic graph representation learning, which exploits the similarity of network behavior between malicious clusters and the association between malicious network hosts and super flows to propagate spatiotemporal information. First, a dynamic graph is constructed to associate all relationships between hosts and super flows, and the dynamic representation of hosts and super flows is maintained. As new traffic appears, the arrival time of the new traffic is encoded, and then it is fused with the representation of the relevant hosts and super flows to update the node information representation. Next, dynamic graph representation learning is used to capture the cluster representation that evolves over time. As new traffic appears, the association degree of each member of the cluster is calculated, and then it is used to update the cluster representation of the entire cluster and the information representation of the included members. Finally, a network classification module is designed to classify super flows to identify malicious attack behavior patterns, and then the corresponding hosts are marked as attack host nodes. The system framework is as follows Figure 2 As shown, it consists of four modules: dynamic traffic processing module, dynamic node representation module, dynamic cluster representation module, and malicious traffic detection module.

[0072] like Figure 1 and Figure 3 As shown, the malicious traffic detection method based on dynamic graph neural network described in the present invention includes the following steps:

[0073] The first step is to obtain traffic data and build a heterogeneous graph: obtain the traffic data of the host and superflow, divide the flow into different superflows according to the quadruple of the network flow, and design a heterogeneous graph.

[0074] Typically, a network flow is characterized by a set of five-tuples [ipsrc, ipdst, portsrc, portdst, proto], where ipsrc is the source IP address, ipdst is the destination IP address, portsrc is the source port, portdst is the destination port, and proto is the protocol type. Networks in the same family often show similarities in attack targets and methods because they usually share similar malware and use the same software framework. Therefore, the present invention proposes the concept of super flows for classifying network flows containing network attacks, and uses [ipdst, abup, abdown, proto] to divide different super flows, where ipdst is the destination IP address, abup is the average number of bytes per data packet of the upstream traffic of the network flow, abdown is the average number of bytes per data packet of the downstream traffic of the network flow, and proto is the protocol type.

[0075] (1) Obtain traffic data of hosts and super flows, and use [ipdst, abup, abdown, proto] to divide different super flows, where ipdst is the destination IP address, abup is the average number of bytes per packet of upstream traffic, abdown is the average number of bytes per packet of downstream traffic, and proto is the protocol type.

[0076] (2) Designing heterogeneous graphs To represent the association between host network flows and superflow nodes, let H represent the set of hosts, each host is uniquely identified by its IP address, let S represent the set of superflows, each superflow is initialized by the characteristics of the first flow connected to it, containing the four-tuple information extracted from the flow, let E represent the set of edges between host network flows and superflow nodes,

[0077] definition ,

[0078] in, and represents all connections between the host and the superflow, where and It is a variable parameter;

[0079] If from the host flow In a specific time window Time within With Super Flow , then the edge connecting these two nodes Add to .

[0080] The second step is to set the representation of dynamic nodes: monitor new network flows. As new network flows appear, the arrival time of the new network flows is encoded, and then it is fused with the representation of the relevant host and super flow to update the node information representation. In order to integrate the arriving traffic with the node memory, we use vectorized representation to represent the new network flow association. Timestamps provide rich temporal information for network behavior patterns. Because network flows occurring at different times can indicate different network activity patterns.

[0081] (1) Use vectorized representation to represent new network flow associations. Network flows occurring at different times indicate different network activity patterns.

[0082] Get a new network stream When an association arrives, calculate the time interval between the network flow and the last network flow in the same superflow , defined as ,

[0083] in, is the timestamp of the current stream, is the timestamp of the previous stream,

[0084] , Timestamp by Encoding,captures temporal features derived from time intervals.

[0085] (2) Time interval Encode and generate time code , the formula is as follows:

[0086] ,

[0087] in, and is a trainable parameter, () is the cosine function.

[0088] (3) Obtaining time code After that, process the network flow association to each host and super flow Generate respective information representation and , used to capture the temporal correlation characteristics of hosts and super flows,

[0089] Information Representation The formula is as follows:

[0090] ,

[0091] in, Represents a super flow exist Time information representation, represents the join operation, implemented as a merge vector, and Representation Node and exist The previous memory state, and is a trainable parameter, is the activation function,

[0092] Calculated in the same way, memory is used to preserve long-term patterns of traffic behavior.

[0093] (4) After obtaining the information representation, use GRU to combine the memory of the relevant nodes with the information representation to update the node memory representation;

[0094] The dynamic memory of the host and superflow is initialized to zero vectors and learned from the global host-superflow association behavior. The formula for this update is as follows:

[0095] ,

[0096] in, Represents a super flow exist The memory state of the moment, Represents a super flow exist The memory state of the previous moment, Represents a super flow exist The information at each moment is represented by GRU, which represents the gated recurrent unit. The same method is used to update the host. Memory status .

[0097] In the third step, dynamic graph representation learning is used to capture cluster representations that evolve over time: as network flows emerge, the relevance of each member of the cluster is calculated, and then used to update the cluster representation of the entire cluster and the information representation of the included members.

[0098] Dynamic cluster detection of continuous-time data using deep learning models is a challenging task. The present invention develops a continuous-time network flow clustering algorithm that aims to learn clustering information of dynamic network behavior. As new network traffic arrives, the clustering structure is gradually updated to reflect the incoming data. The algorithm can not only continuously update the representation of clusters, but also help prevent cluster drift and a large number of numerical matrix calculations. Tend to cluster nodes according to similar traffic characteristics and network behavior, the present invention models the network as a host-superflow association graph and forms superflow clusters based on host behavior. Each cluster is represented by a superflow that embodies the cluster network flow behavior as the cluster center. Hosts with similar behaviors and superflows with similar network flow behaviors are assigned to these clusters. In addition, the cluster structure is continuously updated with the arrival of new network flows.

[0099] (1) When a new network flow association arrives, the graph structure and node representation change, and each participating superflow node is regarded as a cluster center and its neighbors as cluster members;

[0100] For super flow nodes ,Will Treat as a cluster center, for ,use express The set of cluster members in Neighborhood composition;

[0101] In order to measure the degree of association between hosts and clusters, an attention mechanism is used to simulate the member association strength, which is expressed as ,

[0102] use The memory of the members in is the potential cluster Create a representative query vector as follows:

[0103] ,

[0104] in, Indicated in Time The maximum value of the memory state among the cluster members centered is Represents a super flow exist The memory state of the moment, Representation and Clustering Each member of At the moment The associated memory state.

[0105] (2) Use the attention mechanism to calculate the relevance of members , as shown below:

[0106] ,

[0107] ,

[0108] in Indicates members With Super Flow exist The member association degree that is not normalized at the moment, and represents the learnable parameters, Indicated in Time The maximum value of the memory state among the cluster members centered is Indicates members exist Memory status at the moment represents the activation function, Representation Node In its cluster Internal The member association at a certain moment.

[0109] (3) Aggregate clusters based on the calculated membership strength The memory of the internal members is represented by the computing cluster , given by the following formula:

[0110] ,

[0111] in, Represents a cluster At the moment The cluster representation is Representation Node In its cluster Internal The member association at the moment, Indicates members exist The memory state at the moment.

[0112] (4) Hosts connected to the same superflow cluster exhibit similar network behaviors and are more likely to be associated with similar superflow clusters. After obtaining the cluster structure and capturing the cluster representation, messages are propagated throughout the cluster to spread the clustering effect of network behavior. Information representations are generated for directly connected nodes, and this new information is recursively propagated to other cluster members.

[0113] When new network flow When it arrives, its information representation is calculated based on the membership association of other cluster members, which is determined by the following formula:

[0114] ,

[0115] in, Represents a cluster Members of exist The information of the time is shown. Represents a cluster Members of exist The member association at the moment, express exist Information representation at the moment;

[0116] In computing cluster-based information representation back,

[0117] use Update the cluster The memory state of each node in ,This process allows the impact of new network flows to propagate and diffuse throughout the cluster.

[0118] The fourth step is to detect malicious traffic: design a network classification module to classify super flows to identify malicious attack behavior patterns and mark the corresponding hosts as attacking host nodes.

[0119] (1) Pass the test to The super flow in the time period is used to identify malicious traffic, and the obtained super flow node representation is integrated with the cluster representation. The calculation formula is as follows:

[0120] ,

[0121] in, and is a trainable parameter, Represents a cluster exist The cluster representation of time, Represents a cluster exist The memory state at the moment.

[0122] (2) The malicious host detection task is regarded as a classification problem, and the cross entropy function is used as the loss function, which is expressed as follows:

[0123] ,

[0124] in, is the number of training samples, L is the loss function, yes At the moment for The actual probability of yes At the moment for The predicted probability of

[0125] when When , it corresponds to the binary classification problem, and denote the actual label and the model prediction. Samples in to The probability of malicious host behavior in the time window is processed by the Sigmoid function to ensure that the value is between 0 and 1; Indicates that the sample is part of a malicious host behavior. Indicates no.

[0126] By introducing the concept of superflow and capturing temporal correlation through superflow-host correlation graph, the system effectively integrates multiple network features to achieve high detection accuracy. Experimental results on public datasets show that the present invention significantly outperforms the most advanced malicious traffic detection methods, achieving excellent accuracy and recall while maintaining a low false alarm rate. In addition, the present invention performs well in generalization and robustness, proving its effectiveness in different network environments.

[0127] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions only describe the principles of the present invention. The present invention may be subject to various changes and improvements without departing from the spirit and scope of the present invention. These changes and improvements fall within the scope of the present invention. The scope of protection claimed by the present invention is defined by the attached claims and their equivalents.

Claims

1. A malicious traffic detection method based on dynamic graph neural network, characterized in that: The following steps are involved: 11) Obtaining traffic data and building a heterogeneous graph: Obtain traffic data of hosts and super flows, divide the flows into different super flows according to the quadruple of network flows, and design a heterogeneous graph; 12) Perform dynamic node representation setting: monitor new network flows. As new network flows appear, their arrival times are encoded and then fused with the representations of related hosts and super flows to update the node information representation; 13) Use dynamic graph representation learning to capture cluster representations that evolve over time: As network flows emerge, the relevance of each member of the cluster is calculated, and then used to update the cluster representation of the entire cluster and the information representation of the included members; The method of using dynamic graph representation learning to capture cluster representations that evolve over time includes the following steps: 131) When a new network flow association arrives, the graph structure and node representation change, treating each participating superflow node as a cluster center and its neighbors as cluster members; For super flow nodes ,Will Treat as a cluster center, for ,use express The cluster membership set in Neighborhood composition; In order to measure the degree of association between hosts and clusters, an attention mechanism is used to simulate the member association strength, which is expressed as , use The memory of the members in is the potential cluster Create a representative query vector as follows: ， in, Indicated in At all times The maximum value of the memory state among the cluster members centered is Represents a super flow exist The memory state of the moment, Representation and Clustering Each member of At the moment associated memory states; 132) Use the attention mechanism to calculate the relevance of members , as shown below: ， ， in Indicates members With Super Flow exist The member association degree that is not normalized at the moment, and represents the learnable parameters, Indicated in At all times The maximum value of the memory state among the cluster members centered is Indicates members exist Memory status at the moment represents the activation function, Representation Node In its cluster Internal Member relevance at the moment; 133) Aggregate clusters based on calculated membership strengths The memory of the internal members is represented by the computing cluster , given by the following formula: ， in, Represents a cluster At the moment The cluster representation is Representation Node In its cluster Internal The member association at the moment, Indicates members exist The memory state at the moment; 134) Hosts connected to the same superflow cluster exhibit similar network behaviors and are more likely to be associated with similar superflow clusters; after obtaining the cluster structure and capturing the cluster representation, messages are propagated throughout the cluster to spread the cluster effect of network behavior, information representations are generated for directly connected nodes, and this new information is recursively propagated to other cluster members; When new network flow When it arrives, its information representation is calculated based on the membership association of other cluster members, which is determined by the following formula: ， in, Represents a cluster Members of exist The information of the time is shown. Represents a cluster Members of exist The member association at the moment, express exist Information representation at the moment; In computing cluster-based information representation back, use Update the cluster The memory state of each node in ,This process allows the impact of the new network flow to propagate and diffuse throughout the cluster; 14) Detect malicious traffic: Design a network classification module to classify super flows to identify malicious attack behavior patterns and mark the corresponding hosts as attacking host nodes.

2. According to claim 1, a malicious traffic detection method based on dynamic graph neural network is characterized in that: The acquisition of traffic data and construction of a heterogeneous graph include the following steps: 21) Get the traffic data of the host and superflow, and use [ipdst, abup, abdown, proto] to divide different superflows, where ipdst is the target IP address, abup is the average number of bytes per packet of the upstream traffic of the network flow, abdown is the average number of bytes per packet of the downstream traffic of the network flow, and proto is the protocol type; 22) Design heterogeneous graphs To represent the association between host network flows and superflow nodes, let H represent the set of hosts, each host is uniquely identified by its IP address, let S represent the set of superflows, each superflow is initialized by the characteristics of the first flow connected to it, containing the four-tuple information extracted from the flow, let E represent the set of edges between host network flows and superflow nodes, definition , in, and represents all connections between the host and the superflow, where and It is a variable parameter; If from the host flow In a specific time window Time within With Super Flow , then the edge connecting these two nodes Add to .

3. According to claim 1, a malicious traffic detection method based on dynamic graph neural network is characterized in that: The step of setting the representation of the dynamic node comprises the following steps: 31) Use vectorized representation to represent new network flow associations. Network flows occurring at different times indicate different network activity patterns. Get a new network stream When an association arrives, calculate the time interval between the network flow and the last network flow in the same superflow , defined as , in, is the timestamp of the current stream, is the timestamp of the previous stream, , Timestamp by encoding, which captures temporal features derived from time intervals; 32) Time interval Encode and generate time code , the formula is as follows: ， in, and is a trainable parameter, () is the cosine function; 33) Get time code After that, process the network flow association to each host and super flow Generate respective information representation and , used to capture the temporal correlation characteristics of hosts and super flows, Information Representation The formula is as follows: ， in, Represents a super flow exist Time information representation, represents the join operation, implemented as a merge vector, and Representation Node and exist The previous memory state, and is a trainable parameter, is the activation function, Calculated in the same way, memory is used to retain long-term patterns of traffic behavior; 34) After obtaining the information representation, use GRU to combine the memory of the relevant nodes with the information representation to update the node memory representation; The dynamic memory of the host and superflow is initialized to zero vectors and learned from the global host-superflow association behavior. The formula for this update is as follows: ， in, Represents a super flow exist The memory state of the moment, Represents a super flow exist The memory state of the previous moment, Represents a super flow exist The information at each moment is represented by GRU, which represents the gated recurrent unit. The same method is used to update the host. Memory status .

4. According to claim 1, a malicious traffic detection method based on dynamic graph neural network is characterized in that: The detection of malicious traffic includes the following steps: 41) Pass the test to The super flow in the time period is used to identify malicious traffic, and the obtained super flow node representation is integrated with the cluster representation. The calculation formula is as follows: ， in, and is a trainable parameter, Represents a cluster exist The cluster representation of time, Represents a cluster exist The memory state at the moment; 42) The malicious host detection task is regarded as a classification problem, and the cross entropy function is used as the loss function, which is expressed as follows: ， in, is the number of training samples, L is the loss function, yes At the moment for The actual probability of yes At the moment for The predicted probability of when When , it corresponds to the binary classification problem, and denote the actual label and the model prediction. Samples in to The probability of malicious host behavior in the time window is processed by the Sigmoid function to ensure that the value is between 0 and 1; Indicates that the sample is part of a malicious host's behavior. Indicates no.

Images