Intrusion detection method and device based on network flow data, terminal equipment and storage medium

Abstract

The invention discloses an intrusion detection method and device based on network flow data, terminal equipment and a storage medium, and the method can convert the network flow data into a corresponding graph structure used for representing the transmission relation between nodes, so that an intrusion detection model can obtain the feature representation of the whole graph structure. According to the method and the device, the network flow data can be acquired, interaction and mutual influence among the nodes can be captured, so that the internal characteristics of the network flow can be understood more deeply, the final edge characteristics can be generated by aggregating and splicing the internal characteristic vectors, and then the network intrusion type corresponding to the network flow data is generated according to each edge characteristic. According to the method, the network flow data can be converted into the corresponding graph structure, the intrusion detection model can deeply learn and analyze the internal characteristics of the network flow data, the detection capability of unknown network attacks can be improved, potential abnormal behaviors or attack modes can be effectively identified, and the detection efficiency is improved. And the detection accuracy and efficiency are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network intrusion detection, and in particular to an intrusion detection method, device, terminal equipment and storage medium based on network flow data. Background Art

[0002] The IoT system contains a large number of sensors and smart devices, which transmit and control data through the network, forming a complex network environment. However, the openness and heterogeneity of these devices make them easy targets for network attacks. Once an attack occurs, it may have a serious impact on the safe operation of the system. It is often necessary to detect potential intrusions or attack activities by analyzing the traffic data in the network. Real-time monitoring and analysis of network traffic can timely detect and respond to potential intrusions and reduce the damage caused by attacks.

[0003] Traditional intrusion detection methods often detect abnormal behavior by establishing statistical models of network traffic, such as learning normal behavior patterns of traffic based on historical data, and detecting traffic that deviates significantly from the normal pattern as potential intrusion behavior, but it is often difficult to identify unknown or new attack behaviors because these attacks may not conform to the learned normal behavior patterns. Traditional intrusion detection methods cannot deeply learn and analyze the inherent characteristics of network traffic data, and thus have limited detection capabilities for unknown attacks, resulting in the inability to effectively identify potential abnormal behaviors or attack patterns, making network intrusion detection less accurate. Summary of the invention

[0004] The embodiments of the present invention provide an intrusion detection method, apparatus, terminal device and storage medium based on network traffic data, which can convert network traffic data into a corresponding graph structure, and enable an intrusion detection model to extract feature vectors of the graph structure and aggregate and splice each vector, so as to deeply learn and analyze the intrinsic characteristics of network traffic data, and effectively solve the problem that the inherent characteristics of network traffic data cannot be deeply learned and analyzed in the prior art, thereby having limited detection capabilities for unknown attacks and resulting in low accuracy of network intrusion detection.

[0005] An embodiment of the present invention provides an intrusion detection method based on network traffic data, comprising:

[0006] Obtaining network traffic data corresponding to the current time period; wherein the network traffic data includes: transmission data, source data corresponding to the data packet sender, and destination data corresponding to the data packet receiver;

[0007] Converting the network traffic data into a corresponding graph structure for characterizing the transmission relationship between each node; wherein the nodes in the graph structure include: a source node and a destination node;

[0008] The graph structure is input into a preset intrusion detection model, so that the intrusion detection model performs weighted aggregation according to the source node vector, the destination node vector and the connection edge vector between the nodes extracted from the graph structure, and then concatenates the weighted aggregated vectors to generate edge features for characterizing the transmission relationship between the nodes, and generates the network intrusion type corresponding to the graph structure according to the edge features;

[0009] The training of the preset intrusion detection model includes:

[0010] Taking several network traffic data samples and the actual network intrusion type corresponding to each network traffic data sample as input and the predicted network intrusion type of each network traffic data sample as output, the intrusion detection model to be trained is iteratively trained until the model converges to generate a preset intrusion detection model.

[0011] Preferably, the source data includes a source IP address and a source port number; the destination data includes a destination IP address and a destination port number; each source data packet corresponds to a transmission data; the transmission data includes a source sender of the data packet, a receiver of the data packet, a data packet type, a transmission rate, and a data transmission protocol;

[0012] The converting the network traffic data into a corresponding graph structure for characterizing the transmission relationship between the nodes includes:

[0013] For each source data packet, generating a first two-tuple identifier corresponding to the source sender according to the source IP address and the source port; wherein each first two-tuple identifier corresponds to a transmission data;

[0014] For each destination data packet, generating a second two-tuple identifier corresponding to the receiver according to the destination IP address and the destination port number;

[0015] The source sender is taken as the source node in the graph structure and the receiver is taken as the destination node in the graph structure, and then the source nodes and the destination nodes are connected according to the respective binary identifiers and the respective transmission data, so as to generate a graph structure for characterizing the transmission relationship between the nodes; wherein the data corresponding to the connection edge in the graph structure is: the transmission data corresponding to the first binary identifier; the connection edge is the edge connecting a source node and a corresponding destination node.

[0016] Preferably, the intrusion detection model comprises: a feature extraction layer, a graph edge attention layer and a classification layer;

[0017] The generation of the network intrusion type corresponding to the graph structure includes:

[0018] The feature extraction layer in the intrusion detection model is used to extract a plurality of source node vectors, a plurality of destination node vectors and a plurality of connection edge vectors between nodes according to each first two-tuple identifier, each second two-tuple identifier and the transmission data corresponding to each first two-tuple identifier in the graph structure;

[0019] The graph edge attention layer in the intrusion detection model is used to perform weighted aggregation on each source node vector, the source node vector, the destination node vector corresponding to the source node vector, and the connection edge vector corresponding to the source node vector to generate a weighted aggregated source node vector corresponding to the source node vector;

[0020] The classification layer in the intrusion detection model is used to splice the source node vectors after weighted aggregation to generate a number of edge features for characterizing the transmission relationship between nodes; and generate the network intrusion type corresponding to the graph structure according to each edge feature.

[0021] Preferably, for each source node vector, performing weighted aggregation on the source node vector, the destination node vector corresponding to the source node vector, and the connection edge vector corresponding to the source node vector to generate a weighted aggregated source node vector corresponding to the source node vector includes:

[0022] The graph edge attention layer is used to generate an attention coefficient for each connection edge through an attention mechanism according to each source node vector, a destination node vector corresponding to each source node vector, and a connection edge vector corresponding to each source node vector;

[0023] For each connection edge, the attention coefficient is normalized to generate a normalized attention coefficient;

[0024] For each source node vector, based on the corresponding normalized attention coefficient, weighted aggregation is performed on the source node vector, the destination node vector corresponding to the source node vector, and the connection edge vector corresponding to the source node vector to generate a weighted aggregated source node vector.

[0025] Preferably, the graph edge attention layer includes a plurality of attention layers, each of which includes a plurality of attention heads; an attention coefficient corresponding to each attention head;

[0026] The step of performing weighted aggregation on the source node vector, the destination node vector corresponding to the source node vector, and the connection edge vector corresponding to the source node vector based on the corresponding normalized attention coefficient to generate a weighted aggregated source node vector includes:

[0027] For each attention layer in the graph edge attention layer, the attention layer calculates the weighted aggregated source node vector according to the following formula:

[0028]

[0029] in, is the weighted aggregated source node vector of the current attention layer, is the normalized attention coefficient corresponding to the tth attention head of the current attention layer, is the weight matrix of the t-th attention head, is the source node vector of source node i in the previous attention layer, is the connection edge vector of source node i in the previous attention layer, e ij represents the connection edge between source node i and destination node j, is the destination node vector corresponding to the source node i in the previous attention layer, σ represents the scaling factor of the current attention layer, T represents the number of attention heads in the current attention layer, and N i Indicates the total number of destination nodes connected to source node i.

[0030] Preferably, during each iterative training, a network traffic data sample is input into the intrusion detection model, so that the intrusion detection model generates a prediction result of the network intrusion type corresponding to the network traffic data sample according to the edge features corresponding to the network traffic data sample;

[0031] The network intrusion type prediction result is compared with the actual network intrusion type, and the network parameters of the intrusion detection model are adjusted according to the comparison result.

[0032] Preferably, when the intrusion detection model to be trained is iteratively trained, it also includes:

[0033] The parameters of the intrusion detection model are updated according to the following loss function formula:

[0034]

[0035] in, is the prediction error corresponding to the intrusion detection model, N represents the total number of network traffic data samples, M represents the total number of network intrusion types, and β m is the weight factor of network intrusion type m, which is used to balance the importance of each network intrusion type, y nm represents the probability of the actual network intrusion type m corresponding to the network traffic data sample n, is the probability of predicting network intrusion type m in network traffic data sample n, is the adjustment factor used to reduce the weight of easy-to-classify samples.

[0036] Based on the above method embodiments, the present invention provides corresponding device embodiments.

[0037] An embodiment of the present invention provides an intrusion detection device based on network traffic data, comprising: a network traffic data acquisition module, a graph structure conversion module, and a network intrusion type generation module;

[0038] The network traffic data acquisition module is used to acquire the network traffic data corresponding to the current time period; wherein the network traffic data includes: transmission data, source data corresponding to the data packet sender, and destination data corresponding to the data packet receiver;

[0039] The graph structure conversion module is used to convert the network traffic data into a corresponding graph structure for characterizing the transmission relationship between each node; wherein the nodes in the graph structure include: a source node and a destination node;

[0040] The network intrusion type generation module is used to input the graph structure into a preset intrusion detection model, so that the intrusion detection model performs weighted aggregation according to the source node vector, the destination node vector and the connection edge vector between the nodes extracted from the graph structure, and then splices the vectors after each weighted aggregation to generate edge features for characterizing the transmission relationship between the nodes, and generates the network intrusion type corresponding to the graph structure according to each edge feature;

[0041] The training of the preset intrusion detection model includes:

[0042] Taking several network traffic data samples and the actual network intrusion type corresponding to each network traffic data sample as input and the predicted network intrusion type of each network traffic data sample as output, the intrusion detection model to be trained is iteratively trained until the model converges to generate a preset intrusion detection model.

[0043] Based on the above method embodiments, the present invention provides corresponding terminal device embodiments.

[0044] Another embodiment of the present invention provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, an intrusion detection method based on network traffic data described in the above-mentioned embodiment of the invention is implemented.

[0045] Based on the above method embodiments, the present invention provides corresponding storage medium item embodiments.

[0046] Another embodiment of the present invention provides a storage medium, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute an intrusion detection method based on network traffic data as described in the above-mentioned embodiment of the invention.

[0047] The following beneficial effects are achieved by implementing the present invention:

[0048] The embodiment of the present invention provides an intrusion detection method, apparatus, terminal device and storage medium based on network traffic data. After acquiring the network traffic data, the present invention can convert the network traffic data into a corresponding graph structure for characterizing the transmission relationship between each node, so that the graph structure can more intuitively express the association relationship between each element in the network traffic data, such as the association relationship and transmission relationship between the source node in the source data and the destination node in the destination data, so that after the graph structure is input into a preset intrusion detection model, the intrusion detection model can extract each node vector and connection edge vector in the graph based on the nodes in the graph structure and the connection edges representing the association relationship between the nodes. Then, the intrusion detection model of the present invention can obtain the feature representation of the entire graph structure, and can capture the interaction and mutual influence between the nodes, so that the intrinsic characteristics of the network traffic can be more deeply understood. By aggregating and splicing these intrinsic feature vectors, the final edge features for characterizing the transmission relationship between the nodes can be generated, and then the network intrusion type corresponding to the network traffic data can be generated according to each edge feature. Compared with the prior art, the present invention can convert network traffic data into a corresponding graph structure, and enable the intrusion detection model to extract the feature vector of the graph structure, and aggregate and splice each vector, so as to deeply learn and analyze the intrinsic characteristics of network traffic data, improve the detection capability of unknown network attacks, and effectively identify potential abnormal behaviors or attack patterns, thereby improving the accuracy and efficiency of detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 The present invention is a flowchart of an intrusion detection method based on network traffic data provided by an embodiment of the present invention.

[0050] Figure 2 It is a flowchart of intrusion detection model training provided by an embodiment of the present invention.

[0051] Figure 3 It is a structural diagram of an intrusion detection device based on network traffic data provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] like Figure 1 FIG. 1 is a flow chart of an intrusion detection method based on network traffic data provided by an embodiment of the present invention. The intrusion detection method based on network traffic data includes:

[0054] Step S1: Acquire network traffic data corresponding to the current time period; wherein the network traffic data includes: transmission data, source data corresponding to the data packet sender, and destination data corresponding to the data packet receiver;

[0055] Step S2: converting the network traffic data into a corresponding graph structure for characterizing the transmission relationship between each node; wherein the nodes in the graph structure include: a source node and a destination node;

[0056] Step S3: inputting the graph structure into a preset intrusion detection model, so that the intrusion detection model performs weighted aggregation according to the source node vector, the destination node vector and the connection edge vector between the nodes extracted from the graph structure, and then concatenates the weighted aggregated vectors to generate edge features for characterizing the transmission relationship between the nodes, and generates the network intrusion type corresponding to the graph structure according to each edge feature;

[0057] The training of the preset intrusion detection model includes:

[0058] Taking several network traffic data samples and the actual network intrusion type corresponding to each network traffic data sample as input and the predicted network intrusion type of each network traffic data sample as output, the intrusion detection model to be trained is iteratively trained until the model converges to generate a preset intrusion detection model.

[0059] For step S1, the present invention can obtain the network traffic data corresponding to the system in the current time period, so as to identify the corresponding network intrusion type based on the network traffic data in real time, so the present invention can realize the discrimination of the network intrusion type.

[0060] The network traffic data includes transmission data, source data corresponding to the sender of the data packet, and destination data corresponding to the receiver of the data packet.

[0061] By acquiring network traffic data, we can not only focus on the transmission data corresponding to the current time period, but also focus on the sender (source data) and receiver (destination data) of the data, so as to have a more complete and accurate understanding of network behavior. And through the source data and destination data, the present invention can more accurately track and analyze the flow of data packets in the network, so as to more accurately determine whether there is abnormality or intrusion behavior.

[0062] For step S2, in a preferred embodiment, before the present invention identifies the attack type of the network traffic data, the network traffic data can be converted into a corresponding graph structure for characterizing the transmission relationship between each node, and the graph structure includes a number of source nodes and destination nodes, and there are corresponding connection edges between the source nodes and the destination nodes.

[0063] In a preferred embodiment, the source data includes a source IP address and a source port number; the destination data includes a destination IP address and a destination port number;

[0064] Each source data packet corresponds to a transmission data, and the transmission data includes a source sender of the data packet, a receiver of the data packet, a data packet type, a transmission rate, and a data transmission protocol;

[0065] When the network traffic data is converted into a corresponding graph structure for characterizing the transmission relationship between each node, the specific process is as follows:

[0066] For each source data packet, generating a first two-tuple identifier corresponding to the source sender according to the source IP address and the source port; wherein each first two-tuple identifier corresponds to a transmission data;

[0067] For each destination data packet, generating a second two-tuple identifier corresponding to the receiver according to the destination IP address and the destination port number;

[0068] The source sender is used as the source node in the graph structure and the receiver is used as the destination node in the graph structure, and then the source nodes and the destination nodes are connected according to the binary identifiers and the transmission data to generate a graph structure for representing the transmission relationship between the nodes;

[0069] The data corresponding to the connection edge in the graph structure is: the transmission data corresponding to the first two-tuple identifier; the connection edge is an edge connecting a source node and a corresponding destination node.

[0070] Specifically, the network traffic data is first cleaned to remove incomplete data records such as Nan and Infinity to improve the quality of the data set; and the label encoding method is used to convert non-numerical features in the network traffic data into numerical features, and the data features are normalized to ensure that all features are in the same dimension.

[0071] Then, the network traffic data is modeled as a graph structure, in which the source node is identified by a tuple consisting of the source IP address and the source port, the destination node is identified by a tuple consisting of the destination IP address and the destination port, and the remaining flow fields serve as features of the edges related to the two connected nodes.

[0072] G can be used to represent the graph structure, G = (V, E, XV, XE), where V represents the node set, E represents the edge set, XV represents the feature matrix of the node, and XE represents the feature matrix of the edge. The present invention can convert the network intrusion detection problem into a classification problem of edge features in the graph, that is, by analyzing the features of each edge in the graph to determine the type of intrusion behavior.

[0073] The present invention can adapt to different types of network traffic data well through the generation of graph structure. Whether it is simple data packet transmission or complex network interaction, it can be characterized by graph structure. Moreover, after the network traffic data is converted into a graph structure, the intrusion detection model based on graph neural network can be used to perform fast and accurate intrusion detection to improve detection efficiency.

[0074] In the process of generating the graph structure, the present invention can determine the source sender according to each source data packet, and use the source sender as the source node in the graph structure, and determine the receiver based on the destination data packet, and use the receiver as the destination node in the graph structure;

[0075] Furthermore, the source node and the destination node in the graph structure can be determined based on the generated binary identifier. Since the source node corresponds to a source sender, or the destination node corresponds to a receiver, and the transmission data contains the source sender of the data packet and the receiver of the data packet, the transmission data corresponding to the node can be queried through the source node or the destination node, and then the node to be connected to the node can be found based on the transmission data. The two nodes can be connected based on the transmission data, and the transmission data can be used as the data of the current connection edge to obtain the data characteristics corresponding to the connection edge. Alternatively, the two nodes can be connected based on the identifier corresponding to the source node or the destination node and the corresponding transmission data.

[0076] In an embodiment of the present invention, a second two-tuple identifier corresponding to the first two-tuple identifier can be found based on the transmission data corresponding to the first two-tuple identifier, so that the nodes corresponding to the two two-tuple identifiers can be connected, and data characteristics corresponding to the connection (such as data packet type, transmission rate, and data transmission protocol) can be generated based on the corresponding transmission data.

[0077] It can be understood that in actual network traffic, a node (i.e., a combination of IP address + port number) can be both a sender and a receiver of data, and a node can be both a source node and a destination node. The node can correspond to different two-tuple identifiers at the same time to distinguish whether it is a source node or a destination node, and connect to other nodes through corresponding transmission data, thereby generating different connection edges based on different transmission data.

[0078] Specifically, the present invention can clearly distinguish the identity of a node in different transmission scenarios by allocating different binary identifiers to a node.

[0079] When the node is the source sender, it acts as a source node. Assuming that the IP address of the source node is 192.168.1.200 and the port number is 8080, it sends data to another destination node, and the tuple identifier of the destination node is (192.168.1.100,

[5000] ). In the graph structure, the node (192.168.1.200,

[8080] ) as the source node points to the destination node (192.168.1.100,

[5000] ) through a connection edge. This connection edge will be accompanied by relevant transmission data, such as the type, size, timestamp, protocol, etc. of the transmitted data packet.

[0080] When the node is the receiver, it is the destination node, the IP address of the destination node is 192.168.1.300, the port number is 9090, and it receives data through another source node, the binary identifier of the source node is (192.168.1.100,

[6000] ). In the graph structure, the destination node (192.168.1.300,

[9090] ) is pointed to by a connection edge from the source node (192.168.1.100,

[6000] ), and this new connection edge will also contain the relevant transmission data.

[0081] The present invention can accurately identify each sender and receiver in the network traffic by using a binary identifier consisting of a source IP address, a source port number, a destination IP address, and a destination port number, thereby ensuring that the nodes and connecting edges in the graph structure can fully reflect the actual situation of the network traffic. Directly connecting nodes based on binary identifiers and transmission data avoids tedious data matching and conversion processes, and further improves the efficiency of graph structure generation.

[0082] Illustratively, the graph structure of the present invention can flexibly adapt to different types of network traffic data and different analysis requirements. For example, nodes and connecting edges can be added or deleted as needed, or data features can be adjusted to meet specific analysis or detection requirements.

[0083] For step S3, in a preferred embodiment, the embodiment of the present invention can input the converted graph structure into a preset intrusion detection model to automatically identify the corresponding network intrusion type.

[0084] Illustratively, the intrusion detection model of an embodiment of the present invention is a neural network model based on a graph edge attention mechanism, which may be a graph neural network (GNN), which can effectively utilize network topology information and combine node and edge features to capture potential information in the data.

[0085] In the process of training the intrusion detection model, the present invention can input a network traffic data sample into the intrusion detection model during each iterative training, so that the intrusion detection model generates a prediction result of the network intrusion type corresponding to the network traffic data sample according to the edge features corresponding to the network traffic data sample;

[0086] The network intrusion type prediction result is compared with the actual network intrusion type, and the network parameters of the intrusion detection model are adjusted according to the comparison result.

[0087] Furthermore, in a preferred embodiment, the present invention may further include the following process when iteratively training the intrusion detection model to be trained:

[0088] The parameters of the intrusion detection model are updated according to the following loss function formula:

[0089]

[0090] in, is the prediction error corresponding to the intrusion detection model, N represents the total number of network traffic data samples, M represents the total number of network intrusion types, and β m is the weight factor of network intrusion type m, which is used to balance the importance of each network intrusion type, y nmrepresents the probability of the actual network intrusion type m corresponding to the network traffic data sample n, is the probability of predicting network intrusion type m in network traffic data sample n, is the adjustment factor used to reduce the weight of easy-to-classify samples.

[0091] It is understandable that in order to cope with the situation where there are only a few class samples in the model training process, the focal loss function is adopted, so that the model focuses on the minority class samples in the data set during the training process to improve the model classification performance, retaining the characteristics of the cross entropy loss. The focal loss function formula is as follows:

[0092]

[0093] Furthermore, the present invention can also set the adjustment factor γ and the weight factor β m Usually, γ is set to

[0094] Set to 2, β m The calculation formula is as follows:

[0095]

[0096] Among them, number m is the number of samples of category m, sum total is the total number of samples in the training set.

[0097] The embodiment of the present invention adopts a multi-layer perceptron MLP network for classification and improves the problem of sample imbalance through a focal loss function (FocalLoss), so that more attention can be paid to a smaller number of samples during model training, thereby improving the model's recognition ability for a small number of sample categories, making the model more robust and reliable, and thus improving the model classification performance.

[0098] like Figure 2 The flowchart of the intrusion detection model training shown in the figure shows that the embodiment of the present invention can perform data cleaning, label encoding and normalization processing on the collected network traffic, and convert the processed traffic data into a graph structure to generate a network traffic graph structure; and use the multi-head edge attention mechanism through the intrusion detection model to calculate the attention coefficient of each node in the network traffic graph structure, perform weighted aggregation on the node features, and update the edge embedding;

[0099] The updated edge embedding is input into the multi-layer perceptron network, and the weights of easy-to-classify and difficult-to-classify samples are continuously adjusted through the focal loss function to optimize the model; finally, the trained model is used to make classification predictions on new network traffic data, and the prediction results are compared with the true labels to evaluate the model performance.

[0100] In the process of model training, the Adam optimizer can also be used to perform gradient descent in the back propagation stage, the learning rate is set to 0.001, the loss function uses the focus loss function, and the data set is divided into a training set and a test set at a ratio of 3:1. The embodiment of the present invention can also enhance the classification performance, generalization ability and accuracy of the model by setting a series of hyperparameters for model training.

[0101] Schematically, the trained intrusion detection model includes: feature extraction layer, graph edge attention layer and classification layer;

[0102] After the graph structure is input into the intrusion detection model, the feature extraction layer in the intrusion detection model is used to extract a plurality of source node vectors, a plurality of destination node vectors and a plurality of connection edge vectors between nodes according to each first two-tuple identifier, each second two-tuple identifier and the transmission data corresponding to each first two-tuple identifier in the graph structure;

[0103] The graph edge attention layer in the intrusion detection model is used to perform weighted aggregation on each source node vector, the source node vector, the destination node vector corresponding to the source node vector, and the connection edge vector corresponding to the source node vector to generate a weighted aggregated source node vector corresponding to the source node vector;

[0104] The classification layer in the intrusion detection model is used to splice the source node vectors after weighted aggregation to generate a number of edge features for characterizing the transmission relationship between nodes; and generate the network intrusion type corresponding to the graph structure according to each edge feature.

[0105] Among them, based on each source node vector, each destination node vector and each connecting edge vector extracted by the feature extraction layer, an embodiment of the present invention can obtain a weighted aggregated source node vector corresponding to each source node vector through a graph edge attention layer, that is, after calculating the attention coefficient of each edge through the attention mechanism, each source node vector is aggregated according to the attention coefficient of each edge (i.e., connecting edge) to obtain an aggregated node embedding, that is, a weighted aggregated source node vector corresponding to each source node vector is generated.

[0106] Then the processing process of the graph edge attention layer is:

[0107] The graph edge attention layer is used to generate an attention coefficient for each connection edge through an attention mechanism according to each source node vector, a destination node vector corresponding to each source node vector, and a connection edge vector corresponding to each source node vector;

[0108] For each connection edge, the attention coefficient is normalized to generate a normalized attention coefficient;

[0109] For each source node vector, based on the corresponding normalized attention coefficient, weighted aggregation is performed on the source node vector, the destination node vector corresponding to the source node vector, and the connection edge vector corresponding to the source node vector to generate a weighted aggregated source node vector.

[0110] Schematically, the graph edge attention layer of the present invention can connect the embeddings of the source node and the destination node of the previous layer with the embeddings of the edges connected to them, and calculate the attention coefficient of each edge through the attention mechanism, as follows:

[0111]

[0112] In the formula, and Respectively represent node i and edge e ij and the embedding of node j at layer k-1, || represents the concatenation operation of two vectors, W k is the weight matrix of the current layer k for the linear transformation of the input, is a feed-forward neural network.

[0113] The attention coefficient obtained above is normalized to obtain the normalized attention coefficient, which is performed using the softmax function. The normalized attention coefficient is calculated according to the following formula:

[0114]

[0115] Therefore, the normalized attention coefficient can be used to aggregate node i to obtain the aggregated node embedding, that is, the weighted aggregated source node vector

[0116] In a preferred embodiment, the graph edge attention layer includes a plurality of attention layers, each of which includes a plurality of attention heads; an attention coefficient corresponding to each attention head;

[0117] When generating the source node vector after weighted aggregation, it specifically includes:

[0118] For each attention layer in the graph edge attention layer, the attention layer calculates the weighted aggregated source node vector according to the following formula:

[0119]

[0120] in, is the weighted aggregated source node vector of the current attention layer, is the normalized attention coefficient corresponding to the tth attention head of the current attention layer, is the weight matrix of the t-th attention head, is the source node vector of source node i in the previous attention layer, is the connection edge vector of source node i in the previous attention layer, e ij represents the connection edge between source node i and destination node j, is the destination node vector corresponding to the source node i in the previous attention layer, σ represents the scaling factor of the current attention layer, T represents the number of attention heads in the current attention layer, and N i Indicates the total number of destination nodes connected to source node i.

[0121] Furthermore, the classification layer concatenates the weighted aggregated source node vectors to generate several edge features for characterizing the transmission relationship between nodes. Specifically, the embeddings of node i and node j can be concatenated to generate the final edge embedding, and the formula is as follows:

[0122]

[0123] in, It is the edge feature used to characterize the transmission relationship between nodes.

[0124] Furthermore, the present invention adopts a multi-layer perceptron MLP network to perform multi-classification tasks and embed the edge As input features, it is input into the MLP network, and after calculations in multiple hidden layers, the classification results are finally output. The formula is as follows:

[0125]

[0126] in, Represents the class probability vector predicted by the model.

[0127] Illustratively, the feature extraction layer of the present invention extracts each node vector and connection edge vector in the graph based on the nodes in the graph structure and the connection edges representing the association relationship between the nodes, so as to obtain the feature representation of the entire graph structure and capture the interaction and mutual influence between the nodes, thereby achieving a deeper understanding of the intrinsic characteristics of network traffic.

[0128] Moreover, the graph edge attention layer of the present invention adopts a design of multiple attention heads, each of which can independently calculate the attention coefficient and perform weighted aggregation, so that the model can capture a variety of different interaction modes in the network, improving the accuracy and comprehensiveness of recognition. At the same time, the use of multiple attention heads can also increase the capacity of the model, enabling the present invention to handle more complex network structures and traffic patterns.

[0129] Finally, a multi-layer perceptron (MLP) network is used for multi-classification tasks, which can make full use of the information in the edge features and gradually abstract higher-level feature representations through the calculation of multiple hidden layers, thereby improving the accuracy of attack classification and the ability to detect unknown network attacks, and can effectively identify potential abnormal behaviors or attack patterns.

[0130] like Figure 3 As shown, based on the above-mentioned various embodiments of the intrusion detection method based on network traffic data, the present invention provides a corresponding device embodiment;

[0131] An embodiment of the present invention provides an intrusion detection device based on network traffic data, comprising: a network traffic data acquisition module, a graph structure conversion module, and a network intrusion type generation module;

[0132] The network traffic data acquisition module is used to acquire the network traffic data corresponding to the current time period; wherein the network traffic data includes: transmission data, source data corresponding to the data packet sender, and destination data corresponding to the data packet receiver;

[0133] The graph structure conversion module is used to convert the network traffic data into a corresponding graph structure for characterizing the transmission relationship between each node; wherein the nodes in the graph structure include: a source node and a destination node;

[0134] The network intrusion type generation module is used to input the graph structure into a preset intrusion detection model, so that the intrusion detection model performs weighted aggregation according to the source node vector, the destination node vector and the connection edge vector between the nodes extracted from the graph structure, and then splices the vectors after each weighted aggregation to generate edge features for characterizing the transmission relationship between the nodes, and generates the network intrusion type corresponding to the graph structure according to each edge feature;

[0135] The training of the preset intrusion detection model includes:

[0136] Taking several network traffic data samples and the actual network intrusion type corresponding to each network traffic data sample as input and the predicted network intrusion type of each network traffic data sample as output, the intrusion detection model to be trained is iteratively trained until the model converges to generate a preset intrusion detection model.

[0137] It should be noted that the device embodiments described above are merely schematic, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, and may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the accompanying drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. Those of ordinary skill in the art can understand and implement it without paying creative labor.

[0138] Those skilled in the art can clearly understand that, for the sake of convenience and simplicity, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0139] Based on the above-mentioned various embodiments of the intrusion detection method based on network traffic data, the present invention provides corresponding embodiments of terminal equipment items.

[0140] An embodiment of the present invention provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements an intrusion detection method based on network traffic data as described in any method embodiment of the present invention.

[0141] The terminal device may be a computing terminal device such as a desktop computer, a notebook, a palm computer, a cloud server, etc. The terminal device may include, but is not limited to, a processor and a memory.

[0142] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the terminal device, and uses various interfaces and lines to connect various parts of the entire terminal device.

[0143] The memory can be used to store the computer program, and the processor realizes various functions of the terminal device by running or executing the computer program stored in the memory and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the mobile phone, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device or other volatile solid-state storage device.

[0144] Based on the above-mentioned various embodiments of the intrusion detection method based on network traffic data, the present invention provides corresponding storage medium item embodiments.

[0145] An embodiment of the present invention provides a storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute an intrusion detection method based on network traffic data as described in any method embodiment of the present invention.

[0146] The storage medium is a computer-readable storage medium, and the computer program is stored in the computer-readable storage medium. When the computer program is executed by the processor, the steps of each method embodiment described above can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0147] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. An intrusion detection method based on network traffic data, characterized in that: include: Obtaining network traffic data corresponding to the current time period; wherein the network traffic data includes: transmission data, source data corresponding to the data packet sender, and destination data corresponding to the data packet receiver; Converting the network traffic data into a corresponding graph structure for characterizing the transmission relationship between each node; wherein the nodes in the graph structure include: a source node and a destination node; The graph structure is input into a preset intrusion detection model, so that the intrusion detection model performs weighted aggregation according to the source node vector, the destination node vector and the connection edge vector between the nodes extracted from the graph structure, and then concatenates the weighted aggregated vectors to generate edge features for characterizing the transmission relationship between the nodes, and generates the network intrusion type corresponding to the graph structure according to the edge features; The training of the preset intrusion detection model includes: Taking several network traffic data samples and the actual network intrusion type corresponding to each network traffic data sample as input and the predicted network intrusion type of each network traffic data sample as output, the intrusion detection model to be trained is iteratively trained until the model converges to generate a preset intrusion detection model.

2. The intrusion detection method based on network traffic data as claimed in claim 1, characterized in that: The source data includes a source IP address and a source port number; the destination data includes a destination IP address and a destination port number; each source data packet corresponds to a transmission data; the transmission data includes a source sender of the data packet, a receiver of the data packet, a data packet type, a transmission rate, and a data transmission protocol; The converting the network traffic data into a corresponding graph structure for characterizing the transmission relationship between the nodes includes: For each source data packet, generating a first two-tuple identifier corresponding to the source sender according to the source IP address and the source port; wherein each first two-tuple identifier corresponds to a transmission data; For each destination data packet, generating a second two-tuple identifier corresponding to the receiver according to the destination IP address and the destination port number; The source sender is taken as the source node in the graph structure and the receiver is taken as the destination node in the graph structure, and then the source nodes and the destination nodes are connected according to the respective binary identifiers and the respective transmission data, so as to generate a graph structure for characterizing the transmission relationship between the nodes; wherein the data corresponding to the connection edge in the graph structure is: the transmission data corresponding to the first binary identifier; the connection edge is the edge connecting a source node and a corresponding destination node.

3. The intrusion detection method based on network traffic data as claimed in claim 2, characterized in that: The intrusion detection model includes: a feature extraction layer, a graph edge attention layer and a classification layer; The generation of the network intrusion type corresponding to the graph structure includes: The feature extraction layer in the intrusion detection model is used to extract a plurality of source node vectors, a plurality of destination node vectors and a plurality of connection edge vectors between nodes according to each first two-tuple identifier, each second two-tuple identifier and the transmission data corresponding to each first two-tuple identifier in the graph structure; The graph edge attention layer in the intrusion detection model is used to perform weighted aggregation on each source node vector, the source node vector, the destination node vector corresponding to the source node vector, and the connection edge vector corresponding to the source node vector to generate a weighted aggregated source node vector corresponding to the source node vector; The classification layer in the intrusion detection model is used to splice the source node vectors after weighted aggregation to generate a number of edge features for characterizing the transmission relationship between nodes; and generate the network intrusion type corresponding to the graph structure according to each edge feature.

4. The intrusion detection method based on network traffic data as claimed in claim 3, characterized in that: For each source node vector, weighted aggregation is performed on the source node vector, the destination node vector corresponding to the source node vector, and the connection edge vector corresponding to the source node vector to generate a weighted aggregated source node vector corresponding to the source node vector, including: The graph edge attention layer is used to generate an attention coefficient for each connection edge through an attention mechanism according to each source node vector, a destination node vector corresponding to each source node vector, and a connection edge vector corresponding to each source node vector; For each connection edge, the attention coefficient is normalized to generate a normalized attention coefficient; For each source node vector, based on the corresponding normalized attention coefficient, weighted aggregation is performed on the source node vector, the destination node vector corresponding to the source node vector, and the connection edge vector corresponding to the source node vector to generate a weighted aggregated source node vector.

5. The intrusion detection method based on network traffic data as claimed in claim 4, characterized in that: The graph edge attention layer includes a plurality of attention layers, each of which includes a plurality of attention heads; an attention coefficient corresponding to each attention head; The step of performing weighted aggregation on the source node vector, the destination node vector corresponding to the source node vector, and the connection edge vector corresponding to the source node vector based on the corresponding normalized attention coefficient to generate a weighted aggregated source node vector includes: For each attention layer in the graph edge attention layer, the attention layer calculates the weighted aggregated source node vector according to the following formula: in, is the weighted aggregated source node vector of the current attention layer, is the normalized attention coefficient corresponding to the tth attention head of the current attention layer, is the weight matrix of the t-th attention head, is the source node vector of source node i in the previous attention layer, is the connection edge vector of source node i in the previous attention layer, e ij represents the connection edge between source node i and destination node j, is the destination node vector corresponding to the source node i in the previous attention layer, σ represents the scaling factor of the current attention layer, T represents the number of attention heads in the current attention layer, and N i Indicates the total number of destination nodes connected to source node i.

6. The intrusion detection method based on network traffic data as claimed in claim 1, characterized in that: In each iterative training, a network traffic data sample is input into the intrusion detection model, so that the intrusion detection model generates a prediction result of the network intrusion type corresponding to the network traffic data sample according to the edge features corresponding to the network traffic data sample; The network intrusion type prediction result is compared with the actual network intrusion type, and the network parameters of the intrusion detection model are adjusted according to the comparison result.

7. The intrusion detection method based on network traffic data as claimed in claim 1, characterized in that: When iteratively training the intrusion detection model to be trained, it also includes: The parameters of the intrusion detection model are updated according to the following loss function formula: in, is the prediction error corresponding to the intrusion detection model, N represents the total number of network traffic data samples, M represents the total number of network intrusion types, and β m is the weight factor of network intrusion type m, which is used to balance the importance of each network intrusion type, y nm represents the probability of the actual network intrusion type m corresponding to the network traffic data sample n, is the probability of predicting network intrusion type m in network traffic data sample n, is the adjustment factor used to reduce the weight of easy-to-classify samples.

8. An intrusion detection device based on network traffic data, characterized in that: include: Network traffic data acquisition module, graph structure conversion module and network intrusion type generation module; The network traffic data acquisition module is used to acquire the network traffic data corresponding to the current time period; wherein the network traffic data includes: transmission data, source data corresponding to the data packet sender, and destination data corresponding to the data packet receiver; The graph structure conversion module is used to convert the network traffic data into a corresponding graph structure for characterizing the transmission relationship between each node; wherein the nodes in the graph structure include: a source node and a destination node; The network intrusion type generation module is used to input the graph structure into a preset intrusion detection model, so that the intrusion detection model performs weighted aggregation according to the source node vector, the destination node vector and the connection edge vector between the nodes extracted from the graph structure, and then splices the vectors after each weighted aggregation to generate edge features for characterizing the transmission relationship between the nodes, and generates the network intrusion type corresponding to the graph structure according to each edge feature; The training of the preset intrusion detection model includes: Taking several network traffic data samples and the actual network intrusion type corresponding to each network traffic data sample as input and the predicted network intrusion type of each network traffic data sample as output, the intrusion detection model to be trained is iteratively trained until the model converges to generate a preset intrusion detection model.

9. A terminal device, characterized in that: It comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, an intrusion detection method based on network traffic data as described in any one of claims 1 to 7 is implemented.

10. A storage medium, characterized in that: The storage medium includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute an intrusion detection method based on network traffic data as described in any one of claims 1 to 7.

Images