Encrypted malicious traffic detection method and system based on interval constraint traffic diagram

Abstract

The invention provides an interval constraint traffic diagram-based encrypted malicious traffic detection method and system, and the method comprises the steps: constructing an interval constraint-based encrypted traffic diagram, and mapping traffic data to the encrypted traffic diagram with a spatial topological structure for representation; according to the method, the topological relation and time sequence correlation between the traffic data are reserved to the maximum extent, so that an encrypted malicious traffic behavior pattern is depicted more carefully, and meanwhile, the traffic data are directly mapped to a traffic graph with a spatial topological structure for representation through a proposed traffic graph neural network detection model based on a node-level attention mechanism, so that the detection accuracy is improved. And topological information and time correlation between data packets of the encrypted traffic graph can be directly mined by using a traffic graph neural network based on a node-level attention mechanism, and behavior pattern information of malicious traffic is effectively described, so that the detection accuracy of the encrypted malicious traffic is effectively improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network intrusion detection, and in particular relates to an encrypted malicious traffic detection method and system based on an interval constraint traffic graph. Background Art

[0002] With the development of computer network technology, malicious traffic classification has been widely studied, and the goal of these studies is to accurately and effectively distinguish network traffic. However, as encrypted network data continues to grow, the dynamics and complexity of network applications make it more challenging for existing solutions to detect encrypted malicious traffic without decrypting the traffic. It is necessary to design more effective encrypted malicious traffic detection methods to ensure the network security of smart home systems and devices related to the Internet of Things.

[0003] Early traditional network traffic classification methods mainly focused on packet-level analysis based on port information, using port information to identify malicious patterns of data packets. However, with the continuous development of technologies such as dynamic port allocation and network address translation, such methods are no longer reliable. With the rapid development of neural networks, existing artificial intelligence-based malicious traffic classification methods usually extract predefined traffic features and input them into neural network models to predict malicious traffic. Such methods are highly dependent on feature engineering methods, and usually directly extract feature domain knowledge from raw traffic data. However, the inventors found that traffic transmission is usually transmitted along a transmission path in the network topology. The existing methods ignore the strong correlation between real-world network topology and traffic features, that is, the existing methods lack consideration of the particularity of network traffic detection and ignore the important influence and role of real network topology on malicious traffic detection. Secondly, the most widely used artificial intelligence method for existing network traffic classification methods is the traffic classification method based on convolutional neural networks and recurrent neural networks. However, although many existing studies have proved the effectiveness of neural network-based methods in malicious traffic detection, these neural networks were originally designed for image or text fields and cannot be directly applied to network traffic classification tasks with significant graph topology structures. Summary of the invention

[0004] The embodiments of the present invention provide an encrypted malicious traffic detection method and system based on interval-constrained traffic graphs to solve the problems that traditional solutions lack consideration of the particularity of network traffic detection, ignore the important influence and role of real network topology on malicious traffic detection, and the convolutional neural network and recurrent neural network used in traditional solutions are designed for image or text fields and cannot be directly applied to network traffic classification tasks with significant graph topology structures.

[0005] According to a first aspect of an embodiment of the present invention, there is provided a method for detecting encrypted malicious traffic based on an interval-constrained traffic graph, comprising:

[0006] Obtain the encrypted network traffic to be inspected;

[0007] The data packets in the encrypted network traffic to be detected are used as traffic nodes, and the edge relationship is constructed based on the link relationship between the traffic nodes to obtain an encrypted traffic graph based on interval constraints; wherein the encrypted traffic graph is represented as a node attribute feature vector matrix reflecting the characteristics of the traffic nodes and an adjacency matrix reflecting the edge relationship between the traffic nodes;

[0008] Based on the node attribute feature vector matrix and the adjacency matrix, a malicious traffic detection result is obtained through a pre-trained traffic graph neural network detection model based on a node-level attention mechanism;

[0009] Among them, the traffic graph neural network detection model based on the node-level attention mechanism specifically performs the following processing process: for the input node attribute feature vector matrix, weight processing is performed on different node attribute feature vectors through the node-level attention mechanism to obtain the output result based on the node-level attention mechanism; based on the obtained output result based on the node-level attention mechanism, the feature extraction of encrypted network traffic is realized through several graph convolution layers, wherein an adjacency matrix is ​​introduced in each graph convolution layer to guide the feature extraction of network traffic; based on the extracted features of the encrypted network traffic, the encrypted malicious traffic detection result is obtained through a preset classifier.

[0010] Furthermore, the node-level attention mechanism is used to perform weight processing on the feature vectors of different node attributes, specifically: the input node attribute feature vector matrix is ​​compressed through a global average pooling operation to obtain a one-dimensional feature vector; based on the one-dimensional feature vector, a fully connected layer weight matrix is ​​obtained through a fully connected layer; and an output result based on the node-level attention mechanism is obtained by multiplying the node attribute feature vector matrix and the fully connected layer weight matrix.

[0011] Furthermore, the link relationship between the traffic nodes is determined by the following strategy:

[0012] When two traffic nodes have the same source address, there is a link relationship between the two traffic nodes;

[0013] For all traffic nodes with the same destination address, there is a link relationship between them;

[0014] When the sending time interval between two traffic nodes is less than a preset threshold, there is a link relationship between the two traffic nodes.

[0015] Furthermore, the construction of the adjacency matrix is ​​specifically as follows: based on the obtained link relationship between the traffic nodes, the positions of two traffic nodes with a link relationship in the matrix are assigned a value of 1, and the positions without a link relationship are assigned a value of 0, thereby realizing the construction of the adjacency matrix.

[0016] Furthermore, the node attribute feature vector matrix is ​​composed of feature vectors corresponding to a number of traffic nodes, wherein the attribute information contained in the feature vector of each traffic node includes data packet length, protocol type, average time between packets, and timestamp.

[0017] Furthermore, an adjacency matrix is ​​introduced into each graph convolution layer to guide the feature extraction of network traffic. Specifically, the neighborhood information of each node in the encrypted traffic graph based on interval constraints is aggregated by using a graph convolution operation, which is specifically expressed as follows:

[0018]

[0019] Among them, H (l+1) represents the output of the l-th layer graph convolutional network, H (l) represents the input of the lth graph convolutional layer, W (l) represents the weight matrix of the lth layer of the graph convolutional network. The 0th layer input of the graph convolutional layer is the output result based on the node-level attention mechanism. At the same time, after normalizing the domain matrix A by introducing the degree matrix D, we get in, It is obtained by adding the adjacency matrix A to the identity matrix I. It is obtained by adding the degree matrix D to the identity matrix I.

[0020] Furthermore, the classifier adopts Sigmoid function.

[0021] According to a second aspect of an embodiment of the present invention, there is provided an encrypted malicious traffic detection system based on an interval-constrained traffic graph, comprising:

[0022] A data acquisition unit, which is used to acquire encrypted network traffic to be detected;

[0023] A flow graph construction unit, which is used to use data packets in the encrypted network traffic to be detected as flow nodes, construct edge relationships based on link relationships between flow nodes, and obtain an encrypted flow graph based on interval constraints; wherein the encrypted flow graph is represented as a node attribute feature vector matrix reflecting the characteristics of the flow nodes and an adjacency matrix reflecting the edge relationships between the flow nodes;

[0024] A traffic malicious detection unit, which is used to obtain malicious traffic detection results based on the node attribute feature vector matrix and the adjacency matrix through a pre-trained traffic graph neural network detection model based on a node-level attention mechanism;

[0025] Among them, the traffic graph neural network detection model based on the node-level attention mechanism specifically performs the following processing process: for the input node attribute feature vector matrix, weight processing is performed on different node attribute feature vectors through the node-level attention mechanism to obtain the output result based on the node-level attention mechanism; based on the obtained output result based on the node-level attention mechanism, the feature extraction of encrypted network traffic is realized through several graph convolution layers, wherein an adjacency matrix is ​​introduced in each graph convolution layer to guide the feature extraction of network traffic; based on the extracted features of the encrypted network traffic, the encrypted malicious traffic detection result is obtained through a preset classifier.

[0026] According to a third aspect of an embodiment of the present invention, there is provided an electronic device comprising a memory, a processor and a computer program stored and running on the memory, wherein when the processor executes the program, the method for detecting encrypted malicious traffic based on an interval-constrained traffic graph is implemented.

[0027] According to a fourth aspect of an embodiment of the present invention, a non-transitory computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the method for detecting encrypted malicious traffic based on an interval-constrained traffic graph is implemented.

[0028] One or more of the above technical solutions have the following beneficial effects:

[0029] The present invention provides an encrypted malicious traffic detection method and system based on interval constraint traffic graph. The scheme constructs an encrypted traffic graph based on interval constraints, maps traffic data to an encrypted traffic graph representation with a spatial topological structure, and retains the topological relationship and time sequence correlation between traffic data to the greatest extent, thereby more carefully depicting the encrypted malicious traffic behavior pattern.

[0030] The scheme described in the present invention directly maps the traffic data to a traffic graph representation with a spatial topological structure through the proposed traffic graph neural network detection model based on the node-level attention mechanism, and can use the traffic graph neural network based on the node-level attention mechanism to directly mine the topological information and time correlation between data packets in the encrypted traffic graph, effectively characterize the behavioral pattern information of malicious traffic, and thus effectively improve the detection accuracy of encrypted malicious traffic.

[0031] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0033] Figure 1 It is a basic framework schematic diagram of the encrypted malicious traffic detection method based on the interval constraint traffic graph described in an embodiment of the present invention;

[0034] Figure 2 It is a detailed framework diagram of the encrypted malicious traffic detection method based on the interval constraint traffic graph described in an embodiment of the present invention.

[0035] Figure 3 This is a flow chart of an encrypted malicious traffic detection method based on an interval-constrained traffic graph described in an embodiment of the present invention. DETAILED DESCRIPTION

[0036] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0037] It should be noted that the terms used herein are for describing specific embodiments only and are not intended to be limiting of exemplary embodiments according to the present invention.

[0038] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0039] In one or more embodiments, Figure 3 As shown, the embodiment of the present invention provides an encrypted malicious traffic detection method based on an interval constraint traffic graph, including the following processing procedures:

[0040] Step 1: Obtain the encrypted network traffic to be detected;

[0041] In the specific implementation, the encrypted network traffic is obtained by using the third-party network traffic capture tool Scapy to capture data packets with a maximum transmission unit of 1500 bytes in the network, and then extracting network traffic statistical attributes as statistical features for each data packet, such as data packet length, protocol type, average time between packets, timestamp, etc. After the data features and statistical features are extracted, the feature vector can be expressed as: in, For nth i The feature vector of the data, D is the dimension of the feature vector, fea d is the dth feature attribute in the feature vector.

[0042] Step 2: Taking the data packets in the encrypted network traffic to be detected as traffic nodes, constructing edge relationships based on the link relationships between traffic nodes, and obtaining an encrypted traffic graph based on interval constraints; wherein the encrypted traffic graph is represented as a node attribute feature vector matrix reflecting the characteristics of the traffic nodes and an adjacency matrix reflecting the edge relationships between the traffic nodes;

[0043] In a specific implementation, the link relationship between the traffic nodes is determined by the following strategy:

[0044] When two traffic nodes have the same source address, there is a link relationship between the two traffic nodes;

[0045] For all traffic nodes with the same destination address, there is a link relationship between them;

[0046] When the sending time interval between two traffic nodes is less than a preset threshold, there is a link relationship between the two traffic nodes.

[0047] In a specific implementation, the construction of the adjacency matrix is ​​specifically as follows: based on the obtained link relationship between traffic nodes, the positions of two traffic nodes with a link relationship in the matrix are assigned a value of 1, and the positions without a link relationship are assigned a value of 0, thereby realizing the construction of the adjacency matrix.

[0048] In a specific implementation, the node attribute feature vector matrix is ​​composed of feature vectors corresponding to a number of traffic nodes, wherein the attribute information contained in the feature vector of each traffic node includes data packet length, protocol type, average time between packets, and timestamp.

[0049] Specifically, the construction of the encrypted traffic graph based on interval constraints includes the following processing steps:

[0050] (1) Traffic trajectory construction:

[0051] Collect the edge gateway forwarding and transmission traffic, analyze the source IP address and destination IP address of the traffic data packet to determine the source node H src With the destination node H des , determine the forwarding device set according to the flow table [S 1 ,…,S k ,…,S K ] and equipment quantity transmission path H src →(S 1 →S 2 )→(S 2 →S 3 )…→(S K-1 →S K )→H des Finally, the source node H can be determined src With the destination node H desThere is a link relationship. This link relationship will be used to construct the adjacency matrix of the subsequent interval-constrained encrypted flow graph. The adjacency matrix can describe whether there is a link relationship between two nodes.

[0052] (2) Construction of encrypted traffic graph based on interval constraints:

[0053] By constructing an encrypted traffic graph based on interval constraints, network intrusion detection is converted into a node classification task. Specifically, the encrypted traffic graph based on interval constraints is represented by a node set V, a node attribute feature vector matrix X, and an adjacency matrix A. The node set is represented as in, Indicates the nth i Traffic nodes, n v Represents the total number of elements in the node set. The node attribute feature vector matrix X is extracted by the data acquisition and preprocessing module, which contains statistical features such as data packet length and protocol type, and is expressed as Among them, each The feature vector corresponding to a node in the node set, for example, Indicates the nth i Traffic nodes v ni The feature vector of (the feature vector is extracted by extracting the network traffic statistical attributes for each data packet in step 1 as statistical features), where fea d Represents the traffic node v ni One of the features of , D represents the feature vector dimension.

[0054] Among them, the neighborhood matrix A in the encrypted traffic graph based on interval constraints can reflect the edge relationship between traffic nodes. The adjacency matrix A is an n v ×n v The size of the matrix, for example, when the traffic node v ni and v nj If there is a link relationship between them, then the definition of v ni Row v nj Element A of the column (vni,vnj) =1, otherwise, A (vni,vnj) = 0. The neighborhood matrix A defines the link relationship between all traffic nodes, and all link relationships are constructed based on the following strategies:

[0055] Strategy 1: When traffic node v ni and v nj If the two flows have the same source IP, it means that the two flows are sent from the same host. When the host is compromised, all flows sent from the host may be malicious. ni and v nj has a higher correlation and sets A (vni,vnj) =1.

[0056] Strategy 2: During the communication process, traffic is transmitted from the source device to multiple forwarding devices and finally reaches the destination device, which causes the attacker to affect multiple intermediate forwarding devices when launching a flood attack (DoS). All traffic nodes with the same destination address establish a link relationship with each other and set A (v1,v2) =... =A (vni,vnj) =1, where A (vni,vnj) Represents the traffic node v ni and v nj Have a link relationship.

[0057] Strategy 3: Attackers usually launch a large number of malicious attacks in a short period of time. ti and v tj Sending time interval |t i -t j When | is less than T, it indicates that there is a strong temporal correlation between the two malicious flows. Therefore, set A (tni,tnj) =1, where v ti and v tj Respectively represented by t i and t j Traffic sent at any time.

[0058] After the above process, by constructing an encrypted traffic graph based on interval constraints, the spatial and temporal correlation of encrypted malicious traffic is effectively characterized, which can effectively reveal the existence of network intrusion attacks.

[0059] Step 3: Based on the node attribute feature vector matrix and the adjacency matrix, a malicious traffic detection result is obtained through a pre-trained traffic graph neural network detection model based on a node-level attention mechanism;

[0060] Among them, the traffic graph neural network detection model based on the node-level attention mechanism specifically performs the following processing process: for the input node attribute feature vector matrix, weight processing is performed on different node attribute feature vectors through the node-level attention mechanism to obtain the output result based on the node-level attention mechanism; based on the obtained output result based on the node-level attention mechanism, the feature extraction of encrypted network traffic is realized through several graph convolution layers, wherein an adjacency matrix is ​​introduced in each graph convolution layer to guide the feature extraction of network traffic; based on the extracted features of the encrypted network traffic, the encrypted malicious traffic detection result is obtained through a preset classifier.

[0061] In the specific implementation, the node-level attention mechanism is used to perform weight processing on the feature vectors of different node attributes, specifically: the input node attribute feature vector matrix is ​​compressed through a global average pooling operation to obtain a one-dimensional feature vector; based on the one-dimensional feature vector, a fully connected layer weight matrix is ​​obtained through a fully connected layer; and the output result based on the node-level attention mechanism is obtained by multiplying the node attribute feature vector matrix and the fully connected layer weight matrix.

[0062] In the specific implementation, an adjacency matrix is ​​introduced into each graph convolution layer to guide the feature extraction of network traffic. Specifically, the neighborhood information of each node in the encrypted traffic graph based on interval constraints is aggregated by using a graph convolution operation, which is specifically expressed as follows:

[0063]

[0064] Among them, H (l+1) represents the output of the l-th layer graph convolutional network, H (l) represents the input of the lth graph convolutional layer, W (l) represents the weight matrix of the lth layer of the graph convolutional network. The 0th layer input of the graph convolutional layer is the output result based on the node-level attention mechanism. At the same time, after normalizing the domain matrix A by introducing the degree matrix D, we get in, It is obtained by adding the adjacency matrix A to the identity matrix I. It is obtained by adding the degree matrix D to the identity matrix I.

[0065] In a specific implementation, the classifier adopts the Sigmoid function.

[0066] Specifically, the traffic graph neural network detection model based on the node-level attention mechanism specifically performs the following processing:

[0067] The traffic graph neural network detection model based on the node-level attention mechanism is used to build a graph representation learning model to detect encrypted malicious traffic; the traffic graph neural network detection model based on the node-level attention mechanism includes an input layer, a node-level attention learning layer, a graph convolution layer, and a traffic node classification layer. Specifically:

[0068] (1) Input layer:

[0069] It is used to input the encrypted flow graph based on interval constraints into the flow graph neural network model based on the node-level attention mechanism, including the node attribute feature vector matrix X and the adjacency matrix A;

[0070] (2) Node-level attention learning layer:

[0071] It is used to use a global average pooling operation to transform the dimension n v The node attribute feature vector matrix X of ×D is compressed into a 1×D one-dimensional feature vector Z = {z 1 ,…,z d ,…,z D}. This process computes the average representation for each feature column: in, Represents the nth node attribute feature vector matrix X i The eigenvalue of the row and column d, z d represents the average value of the dth column feature. After squeezing and mapping the D feature columns, we get a 1×D one-dimensional feature vector Z = {z 1 ,…,z d ,…,z D Then, we use a single fully connected layer to calculate a weight vector: S = Relu (WZ + B), where W represents the fully connected layer weight matrix and Relu() represents the Relu activation function. Finally, the weight vector S is multiplied by the original node attribute feature vector matrix X to obtain the node-level attention learning layer output: This effectively changes the degree to which the neural network focuses on different features.

[0072] (3) Graph neural network learning layer:

[0073] It is used to aggregate the neighborhood information of each node in the interval-constrained encrypted traffic graph using graph convolution operations: Among them, H (l+1) represents the output of the l-th layer graph convolutional network, H (l) represents the input of the l-th layer graph convolutional network, W (l) Represents the weight matrix of the lth layer of the graph convolutional network. The input of the 0th layer of the graph neural network learning layer is the output of the node-level attention learning layer: In addition, after normalizing the domain matrix A by introducing the degree matrix D, we get in, It is obtained by adding the adjacency matrix A to the identity matrix I: It is obtained by adding the degree matrix D to the identity matrix I: After l layers of graph convolutional network calculations, the final output of the graph neural network learning layer is: H.

[0074] (4) Traffic node classification layer:

[0075] It is used to take the output H of the graph neural network learning layer as input, and use the classifier (the Sigmoid function is used in this embodiment) to output a two-classification result: y=Sigmoid(H), one class represents encrypted malicious traffic, and the other class represents benign traffic.

[0076] In a specific implementation, the classifier usually outputs y=1 to indicate abnormal traffic, and y=0 to indicate normal traffic.

[0077] The above-mentioned traffic graph neural network detection model based on the node-level attention mechanism utilizes traffic time and topology map information to effectively model the continuous changing trend of encrypted malicious traffic, improves the ability to represent encrypted malicious traffic features, and enhances the encrypted malicious traffic detection performance.

[0078] Among them, Figure 1 and Figure 2 As shown, the basic framework and detailed framework diagram of the encrypted malicious traffic detection method based on interval constraint traffic graph described in this embodiment are shown.

[0079] In one or more implementations, corresponding to the above system, this embodiment provides an encrypted malicious traffic detection system based on an interval-constrained traffic graph, including:

[0080] A data acquisition unit, which is used to acquire encrypted network traffic to be detected;

[0081] A flow graph construction unit, which is used to use data packets in the encrypted network traffic to be detected as flow nodes, construct edge relationships based on link relationships between flow nodes, and obtain an encrypted flow graph based on interval constraints; wherein the encrypted flow graph is represented as a node attribute feature vector matrix reflecting the characteristics of the flow nodes and an adjacency matrix reflecting the edge relationships between the flow nodes;

[0082] A traffic malicious detection unit, which is used to obtain malicious traffic detection results based on the node attribute feature vector matrix and the adjacency matrix through a pre-trained traffic graph neural network detection model based on a node-level attention mechanism;

[0083] Among them, the traffic graph neural network detection model based on the node-level attention mechanism specifically performs the following processing process: for the input node attribute feature vector matrix, weight processing is performed on different node attribute feature vectors through the node-level attention mechanism to obtain the output result based on the node-level attention mechanism; based on the obtained output result based on the node-level attention mechanism, the feature extraction of encrypted network traffic is realized through several graph convolution layers, wherein an adjacency matrix is ​​introduced in each graph convolution layer to guide the feature extraction of network traffic; based on the extracted features of the encrypted network traffic, the encrypted malicious traffic detection result is obtained through a preset classifier.

[0084] In further embodiments, there is also provided:

[0085] An electronic device includes a memory and a processor and computer instructions stored in the memory and executed on the processor, wherein the computer instructions, when executed by the processor, perform the method described in the above embodiment. For the sake of brevity, no further description is given here.

[0086] It should be understood that in this embodiment, the processor may be a central processing unit CPU, and the processor may also be other general-purpose processors, digital signal processors DSP, application-specific integrated circuits ASIC, off-the-shelf programmable gate arrays FPGA or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0087] The memory may include a read-only memory and a random access memory, and provide instructions and data to the processor. A portion of the memory may also include a non-volatile random access memory. For example, the memory may also store information about the device type.

[0088] A computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by a processor, the method described in the above embodiment is completed.

[0089] The method in the above embodiment can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor. The software module can be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware. To avoid repetition, it will not be described in detail here.

[0090] Those skilled in the art will appreciate that the units, i.e., algorithm steps, of the various examples described in the present embodiment can be implemented in electronic hardware or in a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this disclosure.

[0091] The above description is only a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. For those skilled in the art, the present disclosure may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. The encrypted malicious traffic detection method based on interval-constrained traffic graph is characterized by: include: Obtain the encrypted network traffic to be inspected; The data packets in the encrypted network traffic to be detected are used as traffic nodes, and the edge relationship is constructed based on the link relationship between the traffic nodes to obtain an encrypted traffic graph based on interval constraints; wherein the encrypted traffic graph is represented as a node attribute feature vector matrix reflecting the characteristics of the traffic nodes and an adjacency matrix reflecting the edge relationship between the traffic nodes; Based on the node attribute feature vector matrix and the adjacency matrix, a malicious traffic detection result is obtained through a pre-trained traffic graph neural network detection model based on a node-level attention mechanism; Among them, the traffic graph neural network detection model based on the node-level attention mechanism specifically performs the following processing process: for the input node attribute feature vector matrix, weight processing is performed on different node attribute feature vectors through the node-level attention mechanism to obtain the output result based on the node-level attention mechanism; based on the obtained output result based on the node-level attention mechanism, the feature extraction of encrypted network traffic is realized through several graph convolution layers, wherein an adjacency matrix is ​​introduced in each graph convolution layer to guide the feature extraction of network traffic; based on the extracted features of the encrypted network traffic, the encrypted malicious traffic detection result is obtained through a preset classifier.

2. The method for detecting encrypted malicious traffic based on interval-constrained traffic graph according to claim 1, characterized in that: The weight processing of different node attribute feature vectors is performed through the node-level attention mechanism, specifically: the input node attribute feature vector matrix is ​​compressed through the global average pooling operation to obtain a one-dimensional feature vector; based on the one-dimensional feature vector, a fully connected layer weight matrix is ​​obtained through the fully connected layer; and the output result based on the node-level attention mechanism is obtained by multiplying the node attribute feature vector matrix and the fully connected layer weight matrix.

3. The encrypted malicious traffic detection method based on interval-constrained traffic graph as claimed in claim 1 is characterized in that: The link relationship between the traffic nodes is determined by the following strategy: When two traffic nodes have the same source address, there is a link relationship between the two traffic nodes; For all traffic nodes with the same destination address, there is a link relationship between them; When the sending time interval between two traffic nodes is less than a preset threshold, there is a link relationship between the two traffic nodes.

4. The method for detecting encrypted malicious traffic based on interval-constrained traffic graph according to claim 1, characterized in that: The construction of the adjacency matrix is ​​specifically as follows: based on the obtained link relationship between the traffic nodes, the positions of two traffic nodes with a link relationship in the matrix are assigned a value of 1, and the positions without a link relationship are assigned a value of 0, thereby realizing the construction of the adjacency matrix.

5. The method for detecting encrypted malicious traffic based on interval-constrained traffic graph according to claim 1, characterized in that: The node attribute feature vector matrix is ​​composed of feature vectors corresponding to a number of traffic nodes, wherein the attribute information contained in the feature vector of each traffic node includes data packet length, protocol type, average time between packets, and timestamp.

6. The method for detecting encrypted malicious traffic based on interval-constrained traffic graph according to claim 1, characterized in that: An adjacency matrix is ​​introduced into each graph convolution layer to guide the feature extraction of network traffic. Specifically, the neighborhood information of each node in the encrypted traffic graph based on interval constraints is aggregated by using a graph convolution operation, which is specifically expressed as follows: Among them, H (l+1) represents the output of the l-th layer graph convolutional network, H (l) represents the input of the lth graph convolutional layer, W (l) represents the weight matrix of the lth layer of the graph convolutional network. The 0th layer input of the graph convolutional layer is the output result based on the node-level attention mechanism. At the same time, after normalizing the domain matrix A by introducing the degree matrix D, we get in, It is obtained by adding the adjacency matrix A to the identity matrix I. It is obtained by adding the degree matrix D to the identity matrix I.

7. The method for detecting encrypted malicious traffic based on interval-constrained traffic graph according to claim 1, characterized in that: The classifier adopts Sigmoid function.

8. The encrypted malicious traffic detection system based on interval-constrained traffic graph is characterized by: include: A data acquisition unit, which is used to acquire encrypted network traffic to be detected; A flow graph construction unit, which is used to use data packets in the encrypted network traffic to be detected as flow nodes, construct edge relationships based on link relationships between flow nodes, and obtain an encrypted flow graph based on interval constraints; wherein the encrypted flow graph is represented as a node attribute feature vector matrix reflecting the characteristics of the flow nodes and an adjacency matrix reflecting the edge relationships between the flow nodes; A traffic malicious detection unit, which is used to obtain malicious traffic detection results based on the node attribute feature vector matrix and the adjacency matrix through a pre-trained traffic graph neural network detection model based on a node-level attention mechanism; Among them, the traffic graph neural network detection model based on the node-level attention mechanism specifically performs the following processing process: for the input node attribute feature vector matrix, weight processing is performed on different node attribute feature vectors through the node-level attention mechanism to obtain the output result based on the node-level attention mechanism; based on the obtained output result based on the node-level attention mechanism, the feature extraction of encrypted network traffic is realized through several graph convolution layers, wherein an adjacency matrix is ​​introduced in each graph convolution layer to guide the feature extraction of network traffic; based on the extracted features of the encrypted network traffic, the encrypted malicious traffic detection result is obtained through a preset classifier.

9. An electronic device, comprising a memory, a processor, and a computer program stored and running on the memory, wherein when the processor executes the program, the method for detecting encrypted malicious traffic based on an interval-constrained traffic graph as described in any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, an encrypted malicious traffic detection method based on an interval-constrained traffic graph as described in any one of claims 1 to 7 is implemented.

Images