Intrusion detection model and method based on historical data and GCN

Abstract

The invention relates to the technical field of intrusion detection of industrial internet, and discloses an intrusion detection model and method based on historical data and GCN, multi-view time sequence data is fed to an embedding module, an embedding result is output, the embedding result and multiple pieces of image data are fed to any number of multi-view space-time modules, the number of the multi-view space-time modules is larger than the number of the multi-view space-time modules, and the number of the multi-view space-time modules is larger than the number of the multi-view space-time modules. The input of each multi-view space-time module is the output of the previous multi-view space-time module and multiple pieces of image data, so that the transition smoothness of the image neural network can be prevented, multiple pieces of prediction information are obtained after processing of the multi-view space-time modules, and the multiple pieces of prediction information are connected together and input into the output module to output a prediction result. According to the method, time and space information is mined from a plurality of views, the space dependence relation formed by different data can be utilized in a crossed mode, interaction between the time views and the space views is captured, and therefore accurate detection of long-sequence logs and flow data can be achieved.

Description

Technical Field

[0001] The present application relates to the field of intrusion detection technology of industrial Internet, and in particular to an intrusion detection model and method based on historical data and GCN. Background Art

[0002] The application of digital technology enables the industrial Internet to achieve comprehensive perception and highly intelligent operation, and strengthens the flexible coordination and interconnection between sources, networks, loads and storage. However, it also brings network security risks to the industrial Internet and has an impact on the existing technical architecture and security protection system.

[0003] At present, the network risk perception technology for the industrial Internet is still insufficient. The existing intrusion detection methods mainly include rule-based, sequence-based and graph matching detection methods. The rule-based detection method mainly summarizes the rules of malicious behavior, such as processes with low permissions having high access rights, downloading files containing unsafe information, etc., and labels the log data to effectively identify attack behaviors. The sequence-based detection method divides the log data into a series of log behavior data through sessions, static time windows or dynamic time windows, and then identifies attack behaviors through unsupervised or supervised learning methods. The graph matching-based detection method constructs malicious behavior as a graph representation, and then compares the graph nodes and structures with the traceability graph of the log data. If it exceeds a certain threshold, it is an attack behavior. Although the above methods can detect intrusion methods, the existing detection methods cannot utilize the spatial dependencies formed by different data forms. Therefore, although the short-term prediction effect is good, the processing capacity for long sequences is insufficient, and the detection accuracy is low. Summary of the invention

[0004] The present application provides an intrusion detection model based on historical data and GCN, aiming to solve the technical problem that the detection methods in the prior art cannot utilize the spatial dependencies formed by different data forms, resulting in insufficient processing capabilities for long sequences and low detection accuracy.

[0005] This application provides an intrusion detection model based on historical data and GCN, including:

[0006] An input module, used for inputting multi-view time series data, wherein the multi-view time series data includes historical data of multiple granularities and multiple image data;

[0007] An embedding module, configured to obtain the multi-view temporal data, generate a plurality of embedding results according to the multi-view temporal data, and feed the plurality of embedding results and a plurality of image data to a multi-view spatiotemporal module;

[0008] A plurality of multi-view spatiotemporal modules, including a first multi-view spatiotemporal module, a second multi-view spatiotemporal module, and a third multi-view spatiotemporal module, wherein:

[0009] a first multi-view spatio-temporal module, configured to output corresponding multiple temporal information and multiple spatial dependency information according to the multiple embedding results and the multiple image data, fuse the multiple temporal information and the multiple spatial dependency information to obtain first fused information, and feed the first fused information as first prediction information and the multiple image data to the second multi-view spatio-temporal module;

[0010] a second multi-view spatio-temporal module, configured to generate second prediction information according to the first prediction information and the plurality of image data, and feed the second prediction information and the plurality of image data to a third multi-view spatio-temporal module;

[0011] A third multi-view spatiotemporal module, configured to generate corresponding third prediction information according to the second prediction information and the plurality of image data;

[0012] The output module is used to generate a prediction result according to the first prediction information, the second prediction information and the third prediction information generated by the multiple multi-view spatiotemporal modules.

[0013] Preferably, the historical data of multiple granularities include recent historical data, daily historical data and weekly historical data, the historical data include session data, time window time series data divided by time windows and neighborhood time series data divided by neighborhoods, the multiple image data include multiple groups of images, each group of images includes an interaction event graph, a time window graph and a neighbor information graph.

[0014] Preferably, the embedded module comprises a first embedded block, a second embedded block and a third embedded block, wherein:

[0015] The first embedding block is used to obtain recent historical data, generate a recent embedding result based on the recent historical data, and feed it to the multi-view spatiotemporal module;

[0016] The second embedding block is used to obtain daily historical data, generate daily embedding results based on the daily historical data, and feed them to the multi-view spatiotemporal module;

[0017] The third embedding block is used to obtain weekly historical data, generate weekly embedding results based on the weekly historical data, and feed them to the multi-view spatiotemporal module.

[0018] Preferably, each multi-view spatiotemporal module comprises a multi-view time learning unit and a first view intelligent fusion unit, wherein:

[0019] The multi-view time learning unit is used to generate a plurality of recent temporal information, a plurality of daily temporal information, and a plurality of weekly temporal information according to a plurality of recent embedding results, a plurality of daily embedding results, and a plurality of weekly embedding results;

[0020] The first view intelligent fusion unit is used to generate multiple optimal fusion ratios according to multiple recent temporal information, multiple daily temporal information and multiple weekly temporal information to integrate the multiple recent temporal information, multiple daily temporal information and multiple weekly temporal information to obtain multiple temporal information.

[0021] Preferably, each multi-view spatiotemporal module comprises a multi-view spatial learning unit and a second view intelligent fusion unit, wherein:

[0022] The multi-view spatial learning unit is used to mine image relationship information based on the interactive event graph, time window graph, and neighbor information graph in each group of images, generate three corresponding mining results, and output the three mining results to the next multi-view fusion module;

[0023] The second view intelligent fusion unit is used to generate corresponding attention coefficients according to multiple temporal information, and perform visual fusion operations on the mining results generated by the multi-view learning unit according to the attention coefficients to obtain fusion information.

[0024] Preferably, the second view intelligent fusion unit is used to map the multiple temporal information as multiple nodes to the key subspace, and calculate the attention score of each node in each layer in the key subspace, wherein the calculation formula is:

[0025]

[0026] Where i represents the number of the node in the key subspace, where i = 1, 2, 3..., represents the attention score of the i-th node in the l-th layer in the critical subspace, represents the mining result of the i-th node in the l-th layer of the input in the key subspace, W represents the trainable weight matrix, and u represents the query vector;

[0027] It is also used to calculate the attention coefficient of each node in each layer in the critical subspace according to the attention score, where the calculation formula is:

[0028]

[0029] Where i represents the number of the node in the key subspace, where i = 1, 2, 3..., represents the attention coefficient of the i-th node in the l-th layer, SoftMax l represents the softmax function, which is used to normalize the attention weights of all nodes in the lth layer into a probability distribution;

[0030] It is also used to perform visual fusion operation on the mining results according to the attention coefficient to obtain fusion information, where the formula corresponding to the visual fusion operation is:

[0031]

[0032] Wherein, i and P both represent the numbers of nodes in the key subspace, where i = 1, 2, 3…P; represents the fusion information of the i-th node in the k-th layer, represents the attention coefficient of the i-th node in the l-th layer, Represents the mining result of the i-th node in the l-th layer of the input in the critical subspace.

[0033] Preferably, the first embedding block, the second embedding block and the third embedding block each include a first fully connected layer, an activation function, a batch normalization, and a second fully connected layer.

[0034] Preferably, the multi-view learning unit includes two graph convolutional network layers connected by a ReLU activation function and batch normalization, each graph convolutional network layer is used to obtain neighbor information and perform edge transfer on the neighbor information, multiply the neighbor information by the edge weight and aggregate it to obtain the aggregated neighbor information, linearly transform the aggregated neighbor information and the node information corresponding to the interaction event graph, the time window graph, and the neighbor information graph, respectively, and add the linear transformation results to obtain the corresponding three mining results.

[0035] The present application also provides an intrusion detection method based on historical data and GCN, including:

[0036] Inputting multi-view time series data, wherein the multi-view time series data includes historical data of multiple granularities and multiple image data;

[0037] Acquire the multi-view time series data, and generate a plurality of embedding results according to the multi-view time series data;

[0038] Outputting corresponding multiple temporal information and multiple spatial dependency relationship information according to the multiple embedding results and the multiple image data, and fusing the multiple temporal information and the multiple spatial dependency relationship information to obtain first fused information;

[0039] generating second prediction information according to the first prediction information and a plurality of image data;

[0040] generating corresponding third prediction information according to the second prediction information and the plurality of image data;

[0041] A prediction result is generated according to the first prediction information, the second prediction information and the third prediction information.

[0042] Preferably, the historical data of multiple granularities include recent historical data, daily historical data and weekly historical data, the historical data include session data, time window time series data divided by time windows and neighborhood time series data divided by neighborhoods, the multiple image data include multiple groups of images, each group of images includes an interaction event graph, a time window graph and a neighbor information graph.

[0043] Preferably, the step of generating a plurality of embedding results according to the multi-view temporal data comprises:

[0044] Obtain recent historical data and generate recent embedding results based on the recent historical data;

[0045] Obtain daily historical data and generate daily embedding results based on the daily historical data;

[0046] Get weekly historical data and generate weekly embedding results based on the weekly historical data.

[0047] The beneficial effects of the present application are as follows: by feeding multi-view time series data to an embedding module, outputting the embedding result through the embedding module, feeding the embedding result and multiple image data to a multi-view spatiotemporal module, any number of multi-view spatiotemporal modules can be set as required, and the input of each multi-view spatiotemporal module is the output of the previous multi-view spatiotemporal module and multiple image data, so as to prevent the transition smoothness of the graph neural network, and after being processed by multiple multi-view spatiotemporal modules, multiple prediction information is obtained, and the multiple prediction information is connected together and input into the output module to output the prediction result. By setting multiple multi-view spatiotemporal modules, time and space information are mined from multiple views, and the spatial dependencies formed by different data can be cross-utilized, and the interaction between time and space views is captured, so that accurate detection of long sequence log and traffic data can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is a schematic diagram of the structure of an intrusion detection model based on historical data and GCN according to an embodiment of the present application.

[0049] Figure 2 The figure is a flowchart of an intrusion detection method based on historical data and GCN according to an embodiment of the present application.

[0050] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0051] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0052] like Figure 1 , Figure 2 As shown, the present application provides an intrusion detection model based on historical data and GCN, including:

[0053] An input module, used for inputting multi-view time series data, wherein the multi-view time series data includes historical data of multiple granularities and multiple image data;

[0054] An embedding module, configured to obtain the multi-view temporal data, generate a plurality of embedding results according to the multi-view temporal data, and feed the plurality of embedding results and a plurality of image data to a multi-view spatiotemporal module;

[0055] A plurality of multi-view spatiotemporal modules, including a first multi-view spatiotemporal module, a second multi-view spatiotemporal module, and a third multi-view spatiotemporal module, wherein:

[0056] a first multi-view spatio-temporal module, configured to output corresponding multiple temporal information and multiple spatial dependency information according to the multiple embedding results and the multiple image data, fuse the multiple temporal information and the multiple spatial dependency information to obtain first fused information, and feed the first fused information as first prediction information and the multiple image data to the second multi-view spatio-temporal module;

[0057] a second multi-view spatio-temporal module, configured to generate second prediction information according to the first prediction information and the plurality of image data, and feed the second prediction information and the plurality of image data to a third multi-view spatio-temporal module;

[0058] A third multi-view spatiotemporal module, configured to generate corresponding third prediction information according to the second prediction information and the plurality of image data;

[0059] The output module is used to generate a prediction result according to the first prediction information, the second prediction information and the third prediction information generated by the multiple multi-view spatiotemporal modules.

[0060] As described above, the present application considers multi-view time series data from both the time and space perspectives. Since multiple time dependencies include two aspects, trend and periodicity, which respectively reflect recent trends and periodic influences, in order to describe multiple time dependencies from different perspectives, the present application considers historical data of different granularities, where granularity refers to the time interval. Multi-view spatial data is also considered, by feeding the multi-view time series data to an embedding module, outputting the embedding result through the embedding module, and feeding the embedding result and multiple image data to a multi-view spatiotemporal module. The multi-view spatiotemporal modules can be set as required, and the input of each multi-view spatiotemporal module is the output of the previous multi-view spatiotemporal and multiple image data. This can prevent the transition smoothness of the graph neural network. After processing by multiple multi-view spatiotemporal modules, multiple prediction information is obtained, and the multiple prediction information is connected together and input into the output module to output the prediction result. This application proposes a multi-space-time graph convolution framework, which makes full use of the space-time dependencies of multiple views and their interactions. By setting up multiple multi-view space-time modules, time and space information is mined from multiple views, and the spatial dependencies formed by different data can be cross-utilized. It also captures the interactions between time and space views, which can achieve accurate detection of long sequences of log and traffic data.

[0061] In one embodiment, historical data of multiple granularities include recent historical data, daily historical data, and weekly historical data, and the historical data include session data, time window time series data divided by time windows, and neighborhood time series data divided by neighborhoods. The multiple image data include multiple groups of images, and each group of images includes an interaction event graph, a time window graph, and a neighbor information graph.

[0062] As mentioned above, we use graph data {G1, G2, …, Gn} to represent complex data networks. For each graph G = {V, E, A}, V is the vertex set used to represent data, E is the edge set, A is the adjacent matrix, and Aij represents the edge weight between data transmission vi and vj. In addition, a path distance graph Gr = {V, Er, Ar} is constructed to characterize the transmission delay in data information, which contains time data. Construct a public data graph, where vertices are connected by various operations, and different operations have intrinsic meanings. In order to more comprehensively describe the data distribution and capture the interactions between operations, we further define the public data graph GT = {V, ET, AT}, Gt = {V, Et, At} to describe the relationship between operations in public data. Interaction event graphs, time window graphs, and neighbor information graphs can be embodied in the form of path distance graphs or public data graphs.

[0063] In one embodiment, the embedding module comprises a first embedding block, a second embedding block and a third embedding block, wherein:

[0064] The first embedding block is used to obtain recent historical data, generate a recent embedding result based on the recent historical data, and feed it to the multi-view spatiotemporal module;

[0065] The second embedding block is used to obtain daily historical data, generate daily embedding results based on the daily historical data, and feed them to the multi-view spatiotemporal module;

[0066] The third embedding block is used to obtain weekly historical data, generate weekly embedding results based on the weekly historical data, and feed them to the multi-view spatiotemporal module.

[0067] As mentioned above, the recent historical data refers to the data within the last 10 minutes. The embedding module extracts features from multi-view time series data to form new feature vectors, namely the recent embedding results, daily embedding results, and weekly embedding results.

[0068] In one embodiment, each multi-view spatiotemporal module includes a multi-view temporal learning unit and a first view intelligent fusion unit, wherein:

[0069] The multi-view time learning unit is used to generate a plurality of recent temporal information, a plurality of daily temporal information and a plurality of weekly temporal information respectively according to a plurality of recent embedding results, a plurality of daily embedding results and a plurality of weekly embedding results;

[0070] The first view intelligent fusion unit is used to generate multiple optimal fusion ratios according to multiple recent temporal information, multiple daily temporal information and multiple weekly temporal information to integrate the multiple recent temporal information, multiple daily temporal information and multiple weekly temporal information to obtain multiple temporal information.

[0071] As mentioned above, the present application considers historical data of three different granularities, so the multi-view temporal learning unit consists of three temporal learning operations, each of which processes historical observations embedded from a single view. The multi-view temporal learning unit produces three outputs, representing different temporal information extracted from different angles. The first view intelligent fusion unit will receive different temporal information and decide the best fusion ratio to integrate the temporal information and generate input for each subsequent image data.

[0072] In one embodiment, each multi-view spatiotemporal module includes a multi-view spatial learning unit and a second view intelligent fusion unit, wherein:

[0073] The multi-view learning unit is used to mine image relationship information based on the interactive event graph, time window graph, and neighbor information graph in each group of images, generate three corresponding mining results, and output the three mining results to the next multi-view fusion module;

[0074] The second view intelligent fusion unit is used to generate corresponding attention coefficients according to multiple temporal information, and perform visual fusion operations on the mining results generated by the multi-view learning unit according to the attention coefficients to obtain fusion information.

[0075] Specifically, the second view intelligent fusion unit is used to map multiple temporal information as multiple nodes to the key subspace, and calculate the attention score of each node in each layer in the key subspace, wherein the calculation formula is:

[0076]

[0077] Where i represents the number of the node in the key subspace, where i = 1, 2, 3..., represents the attention score of the i-th node in the l-th layer in the critical subspace, represents the mining result of the i-th node in the l-th layer of the input in the key subspace, W represents the trainable weight matrix, and u represents the query vector;

[0078] It is also used to calculate the attention coefficient of each node in each layer in the critical subspace according to the attention score, where the calculation formula is:

[0079]

[0080] Where i represents the number of the node in the key subspace, where i = 1, 2, 3..., represents the attention coefficient of the i-th node in the l-th layer, SoftMax l represents the softmax function, which is used to normalize the attention weights of all nodes in the lth layer into a probability distribution;

[0081] It is also used to perform visual fusion operation on the mining results according to the attention coefficient to obtain fusion information, where the formula corresponding to the visual fusion operation is:

[0082]

[0083] Wherein, i and P both represent the numbers of nodes in the key subspace, where i = 1, 2, 3…P; represents the fusion information of the i-th node in the k-th layer, represents the attention coefficient of the i-th node in the l-th layer, Represents the mining result of the i-th node in the l-th layer of the input in the critical subspace.

[0084] As described above, multi-view spatial learning is used to mine relational information from different graphs that represent different spatial dependencies. The input of the multi-view spatial learning unit of the present application is three different graphs, so the output of the multi-view spatial learning unit is three results of passing messages through different graphs. The output of the multi-view spatial learning unit will be fed into the next multi-view fusion module to generate integrated results for subsequent processes. The second view intelligent fusion unit connects the multi-view time learning unit and the multi-view spatial learning unit, and its function is to determine the weights, integrate the outputs of the upstream multi-view time learning unit, and generate integrated results for the downstream multi-view spatial learning unit. The present application determines the ideal weights based on the visual attention mechanism to integrate information from different spatial or temporal views. Since the importance of information from each upstream view may be different for each downstream view, the multi-view fusion block assigns different attention coefficients to each downstream block respectively. For example, assume that the upstream multi-view learning block has P views and the downstream multi-view learning block has Q views. Then set up Q independent attention-based visual fusion operations. Each operation processes all the previous P views and fuses the results of one of the Q subsequent views. The input of each multi-view fusion operation can be formulated as X = {X(1), X(2), …, X(P)}, X(l)∈R (l=1, 2, …P), and F is the feature dimension of each node. To integrate the multi-view temporal information, first, we use a shared linear transformation W∈R F×F 'Affine each node's features to the key subspace. Then, by The similarity with the query vector u is used to calculate the attention score of each layer, where u∈R 1×F ' is an adaptive context embedding, randomly initialized and learned. During the entire training process, after the SoftMax operation, the attention score is applied to different views (values) to obtain a weighted sum. The mechanism of the fusion operation of each view of node i is described as follows:

[0085]

[0086] in, represents the attention score of the i-th node in the l-th layer, represents the multi-view fusion operation of the i-th node in the l-th layer of the input, W represents the trainable weight matrix, u represents the query vector, Represents the attention coefficient of the i-th node in the l-th layer, where the attention coefficient represents the importance of the i-th node to other nodes in the current l-th layer; SoftMax l , represents the softmax function, which is used to normalize the attention weights of all nodes in the lth layer into a probability distribution. Represents the feature vector of the i-th node in the k-th layer, i.e., the fusion information. Multi-view fusion consists of Q per-view operations, generating a total of Q outputs for downstream learning, where represents the fusion information of the kth output of 1≤k≤Q. This embodiment is based on the fusion of view attention, adaptively identifies the importance of each upstream view, fuses multi-view information, and generates a comprehensive result of the downstream view.

[0087] In one embodiment, the first embedding block, the second embedding block and the third embedding block are all composed of a multi-layer neural network, including a first fully connected layer, an activation function, a batch normalization, and a second fully connected layer.

[0088] The output module includes a fully connected layer, an activation function, a batch normalization, a dropout layer, and a fully connected layer. By setting the dropout layer, overfitting can be prevented.

[0089] In one embodiment, the multi-view learning unit includes two graph convolutional networks (GCNs) connected by ReLU activation functions and batch normalization, each graph convolutional network is used to obtain neighbor information and perform edge transfer on the neighbor information, multiply the neighbor information by the edge weight and aggregate it to obtain the aggregated neighbor information, perform linear transformation on the aggregated neighbor information and the node information corresponding to the interaction event graph, the time window graph, and the neighbor information graph, respectively, and add the linear transformation results to obtain the corresponding three mining results.

[0090] As mentioned above, we choose a dilated temporal convolutional network (TCN) to process each temporal data, and in each temporal learning, we have two temporal convolutional networks connected by ReLU activation function and BN layer. In addition, both the dilation operation and multi-granularity data maintain a large receptive field, which helps to capture long-term temporal dependencies.

[0091] The present application also provides an intrusion detection method based on historical data and GCN, including:

[0092] S1. Input multi-view time series data, wherein the multi-view time series data includes historical data of multiple granularities and multiple image data;

[0093] S2. Acquire the multi-view time series data, and generate a plurality of embedding results according to the multi-view time series data;

[0094] S3, outputting corresponding multiple temporal information and multiple spatial dependency relationship information according to the multiple embedding results and the multiple image data, and fusing the multiple temporal information and the multiple spatial dependency relationship information to obtain first fused information;

[0095] S4, generating second prediction information according to the first prediction information and a plurality of image data;

[0096] S5, generating corresponding third prediction information according to the second prediction information and the plurality of image data;

[0097] S6. Generate a prediction result according to the first prediction information, the second prediction information and the third prediction information.

[0098] In one embodiment, historical data of multiple granularities include recent historical data, daily historical data, and weekly historical data, the historical data include session data, time window time series data divided by time windows, and neighborhood time series data divided by neighborhoods, and the multiple image data include multiple groups of images, each group of images includes an interaction event graph, a time window graph, and a neighbor information graph.

[0099] In one embodiment, the step S2 of generating a plurality of embedding results according to the multi-view temporal data comprises:

[0100] S21, obtaining recent historical data and generating a recent embedding result according to the recent historical data;

[0101] S22, obtaining daily historical data and generating daily embedding results according to the daily historical data;

[0102] S23. Obtain weekly historical data and generate weekly embedding results based on the weekly historical data.

[0103] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing related hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media provided in this application and used in the embodiments may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0104] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, device, article or method including the element.

[0105] The above description is only a preferred embodiment of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. An intrusion detection model based on historical data and GCN, characterized in that: include: An input module, used for inputting multi-view time series data, wherein the multi-view time series data includes historical data of multiple granularities and multiple image data; An embedding module, configured to obtain the multi-view temporal data, generate a plurality of embedding results according to the multi-view temporal data, and feed the plurality of embedding results and a plurality of image data to a multi-view spatiotemporal module; A plurality of multi-view spatiotemporal modules, including a first multi-view spatiotemporal module, a second multi-view spatiotemporal module, and a third multi-view spatiotemporal module, wherein: a first multi-view spatio-temporal module, configured to output corresponding multiple temporal information and multiple spatial dependency information according to the multiple embedding results and the multiple image data, fuse the multiple temporal information and the multiple spatial dependency information to obtain first fused information, and feed the first fused information as first prediction information and the multiple image data to the second multi-view spatio-temporal module; a second multi-view spatio-temporal module, configured to generate second prediction information according to the first prediction information and the plurality of image data, and feed the second prediction information and the plurality of image data to a third multi-view spatio-temporal module; A third multi-view spatiotemporal module, configured to generate corresponding third prediction information according to the second prediction information and the plurality of image data; The output module is used to generate a prediction result according to the first prediction information, the second prediction information and the third prediction information generated by the multiple multi-view spatiotemporal modules.

2. The intrusion detection model based on historical data and GCN according to claim 1, characterized in that: The historical data of multiple granularities include recent historical data, daily historical data, and weekly historical data. The historical data include session data, time window time series data divided by time windows, and neighborhood time series data divided by neighborhoods. The multiple image data include multiple groups of images, and each group of images includes an interaction event graph, a time window graph, and a neighbor information graph.

3. The intrusion detection model based on historical data and GCN according to claim 2, characterized in that: The embedding module comprises a first embedding block, a second embedding block and a third embedding block, wherein: The first embedding block is used to obtain recent historical data, generate a recent embedding result based on the recent historical data, and feed it to the multi-view spatiotemporal module; The second embedding block is used to obtain daily historical data, generate daily embedding results based on the daily historical data, and feed them to the multi-view spatiotemporal module; The third embedding block is used to obtain weekly historical data, generate weekly embedding results based on the weekly historical data, and feed them to the multi-view spatiotemporal module.

4. The intrusion detection model based on historical data and GCN according to claim 3 is characterized in that: Each multi-view spatiotemporal module includes a multi-view temporal learning unit and a first view intelligent fusion unit, wherein: The multi-view time learning unit is used to generate a plurality of recent temporal information, a plurality of daily temporal information, and a plurality of weekly temporal information according to a plurality of recent embedding results, a plurality of daily embedding results, and a plurality of weekly embedding results; The first view intelligent fusion unit is used to generate multiple optimal fusion ratios according to multiple recent temporal information, multiple daily temporal information and multiple weekly temporal information to integrate the multiple recent temporal information, multiple daily temporal information and multiple weekly temporal information to obtain multiple temporal information.

5. The intrusion detection model based on historical data and GCN according to claim 3, characterized in that: Each multi-view spatiotemporal module includes a multi-view spatial learning unit and a second view intelligent fusion unit, wherein: The multi-view spatial learning unit is used to mine image relationship information based on the interactive event graph, time window graph, and neighbor information graph in each group of images, generate three corresponding mining results, and output the three mining results to the next multi-view fusion module; The second view intelligent fusion unit is used to generate corresponding attention coefficients according to multiple temporal information, and perform visual fusion operations on the mining results generated by the multi-view learning unit according to the attention coefficients to obtain fusion information.

6. The intrusion detection model based on historical data and GCN according to claim 5, characterized in that: The second view intelligent fusion unit is used to map the multiple temporal information as multiple nodes to the key subspace, and calculate the attention score of each node in each layer in the key subspace, wherein the calculation formula is: Where i represents the number of the node in the key subspace, where i = 1, 2, 3..., represents the attention score of the i-th node in the l-th layer in the critical subspace, represents the mining result of the i-th node in the l-th layer of the input in the key subspace, W represents the trainable weight matrix, and u represents the query vector; It is also used to calculate the attention coefficient of each node in each layer in the critical subspace according to the attention score, where the calculation formula is: Where i represents the number of the node in the key subspace, where i = 1, 2, 3..., represents the attention coefficient of the i-th node in the l-th layer, SoftMax l represents the softmax function, which is used to normalize the attention weights of all nodes in the lth layer into a probability distribution; It is also used to perform visual fusion operation on the mining results according to the attention coefficient to obtain fusion information, where the formula corresponding to the visual fusion operation is: Wherein, i and P both represent the numbers of nodes in the key subspace, where i = 1, 2, 3…P; represents the fusion information of the i-th node in the k-th layer, represents the attention coefficient of the i-th node in the l-th layer, Represents the mining result of the i-th node in the l-th layer of the input in the critical subspace.

7. The intrusion detection model based on historical data and GCN according to claim 3, characterized in that: The first embedding block, the second embedding block and the third embedding block each include a first fully connected layer, an activation function, a batch normalization, and a second fully connected layer.

8. The intrusion detection model based on historical data and GCN according to claim 4, characterized in that: The multi-view learning unit includes two graph convolutional network layers connected by ReLU activation function and batch normalization. Each graph convolutional network layer is used to obtain neighbor information and perform edge transmission on the neighbor information. The neighbor information is multiplied by the edge weight and aggregated to obtain the aggregated neighbor information. The aggregated neighbor information and the node information corresponding to the interaction event graph, the time window graph, and the neighbor information graph are linearly transformed and the linear transformation results are added to obtain the corresponding three mining results.

9. An intrusion detection method based on historical data and GCN, characterized in that: include: Inputting multi-view time series data, wherein the multi-view time series data includes historical data of multiple granularities and multiple image data; Acquire the multi-view time series data, and generate a plurality of embedding results according to the multi-view time series data; Outputting corresponding multiple temporal information and multiple spatial dependency relationship information according to the multiple embedding results and the multiple image data, and fusing the multiple temporal information and the multiple spatial dependency relationship information to obtain first fused information; generating second prediction information according to the first prediction information and a plurality of image data; generating corresponding third prediction information according to the second prediction information and the plurality of image data; A prediction result is generated according to the first prediction information, the second prediction information and the third prediction information.

10. The intrusion detection method based on historical data and GCN according to claim 1, characterized in that: The historical data of multiple granularities include recent historical data, daily historical data, and weekly historical data. The historical data include session data, time window time series data divided by time windows, and neighborhood time series data divided by neighborhoods. The multiple image data include multiple groups of images, and each group of images includes an interaction event graph, a time window graph, and a neighbor information graph.

Images