An intrusion detection method and device based on network traffic data, a terminal device and a storage medium

Abstract

The application discloses an intrusion detection method and device based on network flow data, terminal equipment and storage medium, which can convert network flow data into corresponding graph structure for representing transmission relationship between nodes, so that the intrusion detection model can obtain feature representation of the entire graph structure and capture the interaction and mutual influence between nodes, thereby more deeply understanding the internal characteristics of network flow data, and generating the final edge feature by aggregating and splicing the internal feature vectors, and then generating the network intrusion type corresponding to the network flow data according to each edge feature. The application can convert network flow data into corresponding graph structure, and enable the intrusion detection model to deeply learn and analyze the internal characteristics of network flow data, thereby improving the detection capability of unknown network attacks, and effectively identifying potential abnormal behaviors or attack patterns, improving the detection accuracy and efficiency.

Description

Technical Field

[0001] The present invention relates to the technical field of network intrusion detection, and in particular to an intrusion detection method, apparatus, terminal equipment and storage medium based on network flow data. Background Art

[0002] IoT systems contain numerous sensors and smart devices that transmit and control data over the network, creating a complex network environment. However, the openness and heterogeneity of these devices make them vulnerable to cyberattacks. Once an attack occurs, it can severely impact the secure operation of the system. Therefore, it is often necessary to analyze network traffic data to detect potential intrusions or attacks. Real-time monitoring and analysis of network traffic can promptly detect and respond to potential intrusions, minimizing the damage caused by attacks.

[0003] Traditional intrusion detection methods often detect abnormal behavior by building statistical models of network traffic. For example, they learn normal traffic patterns based on historical data and detect traffic that deviates significantly from these patterns as potential intrusions. However, these methods often struggle to identify unknown or new attack behaviors, as these attacks may not conform to the learned normal behavior patterns. Traditional intrusion detection methods are unable to deeply learn and analyze the inherent characteristics of network traffic data, limiting their ability to detect unknown attacks. This results in an inability to effectively identify potential abnormal behavior or attack patterns, leading to low accuracy in network intrusion detection. Summary of the Invention

[0004] The embodiments of the present invention provide an intrusion detection method, apparatus, terminal device and storage medium based on network traffic data, which can convert network traffic data into a corresponding graph structure, and enable the intrusion detection model to extract the feature vectors of the graph structure and aggregate and splice the individual vectors, thereby being able to deeply learn and analyze the intrinsic characteristics of network traffic data, and effectively solving the problem in the prior art that the intrinsic characteristics of network traffic data cannot be deeply learned and analyzed, thereby having limited detection capabilities for unknown attacks and resulting in low accuracy of network intrusion detection.

[0005] An embodiment of the present invention provides an intrusion detection method based on network traffic data, comprising:

[0006] Obtaining network traffic data corresponding to the current time period; wherein the network traffic data includes: transmission data, source data corresponding to the data packet sender, and destination data corresponding to the data packet receiver;

[0007] Converting the network traffic data into a corresponding graph structure for representing the transmission relationship between each node; wherein the nodes in the graph structure include: a source node and a destination node;

[0008] Inputting the graph structure into a preset intrusion detection model, so that the intrusion detection model performs weighted aggregation based on the source node vector, the destination node vector, and the connection edge vectors between the nodes extracted from the graph structure, and then splicing the weighted aggregated vectors to generate edge features for characterizing the transmission relationship between the nodes, and generating the network intrusion type corresponding to the graph structure based on the edge features;

[0009] The training of the preset intrusion detection model includes:

[0010] Taking several network traffic data samples and the actual network intrusion type corresponding to each network traffic data sample as input, and the predicted network intrusion type of each network traffic data sample as output, the intrusion detection model to be trained is iteratively trained until the model converges to generate a preset intrusion detection model.

[0011] Preferably, the source data includes a source IP address and a source port number; the destination data includes a destination IP address and a destination port number; each source data packet corresponds to a transmission data; the transmission data includes a source sender of the data packet, a receiver of the data packet, a data packet type, a transmission rate, and a data transmission protocol;

[0012] The converting the network traffic data into a corresponding graph structure for representing the transmission relationship between each node includes:

[0013] For each source data packet, generating a first two-tuple identifier corresponding to the source sender according to the source IP address and the source port; wherein each first two-tuple identifier corresponds to a piece of transmission data;

[0014] For each destination data packet, generating a second two-tuple identifier corresponding to the recipient according to the destination IP address and the destination port number;

[0015] The source sender is taken as the source node in the graph structure and the receiver is taken as the destination node in the graph structure. Then, according to each binary identifier and each transmission data, each source node and each destination node are connected to generate a graph structure for characterizing the transmission relationship between each node; wherein the data corresponding to the connection edge in the graph structure is: the transmission data corresponding to the first binary identifier; the connection edge is the edge connecting a source node and a corresponding destination node.

[0016] Preferably, the intrusion detection model comprises: a feature extraction layer, a graph edge attention layer, and a classification layer;

[0017] The generation of the network intrusion type corresponding to the graph structure includes:

[0018] The feature extraction layer in the intrusion detection model is used to extract a plurality of source node vectors, a plurality of destination node vectors, and a plurality of connection edge vectors between nodes based on each first two-tuple identifier, each second two-tuple identifier, and the transmission data corresponding to each first two-tuple identifier in the graph structure;

[0019] The graph edge attention layer in the intrusion detection model is used to perform weighted aggregation on each source node vector, the source node vector, the destination node vector corresponding to the source node vector, and the connection edge vector corresponding to the source node vector to generate a weighted aggregated source node vector corresponding to the source node vector;

[0020] The classification layer in the intrusion detection model is used to splice the source node vectors after weighted aggregation to generate a number of edge features for characterizing the transmission relationship between nodes; and generate the network intrusion type corresponding to the graph structure according to each edge feature.

[0021] Preferably, for each source node vector, performing weighted aggregation on the source node vector, the destination node vector corresponding to the source node vector, and the connection edge vector corresponding to the source node vector to generate a weighted aggregated source node vector corresponding to the source node vector includes:

[0022] The graph edge attention layer is used to generate an attention coefficient for each connection edge through an attention mechanism based on each source node vector, the destination node vector corresponding to each source node vector, and the connection edge vector corresponding to each source node vector;

[0023] For each connection edge, normalize the attention coefficient to generate a normalized attention coefficient;

[0024] For each source node vector, based on the corresponding normalized attention coefficient, the source node vector, the destination node vector corresponding to the source node vector, and the connection edge vector corresponding to the source node vector are weightedly aggregated to generate a weighted aggregated source node vector.

[0025] Preferably, the graph edge attention layer includes several attention layers, each attention layer includes several attention heads; an attention coefficient corresponding to each attention head;

[0026] The step of performing weighted aggregation on the source node vector, the destination node vector corresponding to the source node vector, and the connection edge vector corresponding to the source node vector based on the corresponding normalized attention coefficient to generate a weighted aggregated source node vector includes:

[0027] For each attention layer in the graph edge attention layer, the attention layer calculates the weighted aggregated source node vector according to the following formula:

[0028]

[0029] in, is the weighted aggregated source node vector of the current attention layer, is the normalized attention coefficient corresponding to the t-th attention head of the current attention layer, is the weight matrix of the t-th attention head, is the source node vector of source node i in the previous attention layer, is the connection edge vector of source node i in the previous attention layer, e ij represents the connection edge between source node i and destination node j, is the destination node vector corresponding to the source node i in the previous attention layer, σ represents the scaling factor of the current attention layer, T represents the number of attention heads in the current attention layer, N i Indicates the total number of destination nodes connected to source node i.

[0030] Preferably, during each iterative training, a network traffic data sample is input into the intrusion detection model, so that the intrusion detection model generates a prediction result of the network intrusion type corresponding to the network traffic data sample based on the edge features corresponding to the network traffic data sample;

[0031] The network intrusion type prediction result is compared with the actual network intrusion type, and the network parameters of the intrusion detection model are adjusted according to the comparison result.

[0032] Preferably, when performing iterative training on the intrusion detection model to be trained, the method further includes:

[0033] The parameters of the intrusion detection model are updated according to the following loss function formula:

[0034]

[0035] in, is the prediction error corresponding to the intrusion detection model, N represents the total number of network traffic data samples, M represents the total number of network intrusion types, and β m is the weight factor of network intrusion type m, which is used to balance the importance of each network intrusion type, y nm represents the probability of the actual network intrusion type m corresponding to the network traffic data sample n, is the probability of predicting network intrusion type m in network traffic data sample n, is an adjustment factor used to reduce the weight of easy-to-classify samples.

[0036] Based on the above method embodiments, the present invention provides corresponding device embodiments.

[0037] An embodiment of the present invention provides an intrusion detection device based on network traffic data, comprising: a network traffic data acquisition module, a graph structure conversion module, and a network intrusion type generation module;

[0038] The network traffic data acquisition module is used to acquire network traffic data corresponding to the current time period; wherein the network traffic data includes: transmission data, source data corresponding to the data packet sender, and destination data corresponding to the data packet receiver;

[0039] The graph structure conversion module is used to convert the network traffic data into a corresponding graph structure for representing the transmission relationship between each node; wherein the nodes in the graph structure include: a source node and a destination node;

[0040] The network intrusion type generation module is used to input the graph structure into a preset intrusion detection model, so that the intrusion detection model performs weighted aggregation based on the source node vector, destination node vector, and connection edge vectors between nodes extracted from the graph structure, and then splices each weighted aggregated vector to generate edge features for characterizing the transmission relationship between nodes, and generates the network intrusion type corresponding to the graph structure based on each edge feature;

[0041] The training of the preset intrusion detection model includes:

[0042] Taking several network traffic data samples and the actual network intrusion type corresponding to each network traffic data sample as input, and the predicted network intrusion type of each network traffic data sample as output, the intrusion detection model to be trained is iteratively trained until the model converges to generate a preset intrusion detection model.

[0043] Based on the above method embodiments, the present invention provides corresponding terminal device embodiments.

[0044] Another embodiment of the present invention provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the intrusion detection method based on network traffic data described in the above-mentioned embodiment of the invention.

[0045] Based on the above method embodiment, the present invention provides a corresponding storage medium embodiment.

[0046] Another embodiment of the present invention provides a storage medium, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute an intrusion detection method based on network traffic data as described in the above-mentioned embodiment of the invention.

[0047] The following beneficial effects are achieved by implementing the present invention:

[0048] An embodiment of the present invention provides an intrusion detection method, apparatus, terminal device and storage medium based on network traffic data. After acquiring network traffic data, the present invention can convert the network traffic data into a corresponding graph structure for characterizing the transmission relationship between each node, so that the graph structure can more intuitively express the association relationship between each element in the network traffic data, such as the association relationship and transmission relationship between the source node in the source data and the destination node in the destination data, so that after the graph structure is input into a preset intrusion detection model, the intrusion detection model can extract each node vector and connection edge vector in the graph based on the nodes in the graph structure and the connection edges representing the association relationship between the nodes. The intrusion detection model of the present invention can obtain a feature representation of the entire graph structure and can capture the interaction and mutual influence between the nodes, so that the intrinsic characteristics of the network traffic can be understood more deeply. By aggregating and splicing these intrinsic feature vectors, the final edge features for characterizing the transmission relationship between the nodes can be generated, and then the network intrusion type corresponding to the network traffic data can be generated according to each edge feature. Compared with the existing technology, the present invention can convert network traffic data into a corresponding graph structure, and enable the intrusion detection model to extract the feature vectors of the graph structure, and aggregate and splice each vector, so as to deeply learn and analyze the intrinsic characteristics of network traffic data, improve the detection ability of unknown network attacks, and effectively identify potential abnormal behaviors or attack patterns, thereby improving the accuracy and efficiency of detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 The figure is a flow chart of an intrusion detection method based on network traffic data provided by one embodiment of the present invention.

[0050] Figure 2 This is a flow chart of intrusion detection model training provided by one embodiment of the present invention.

[0051] Figure 3 The figure is a schematic structural diagram of an intrusion detection device based on network traffic data provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0052] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0053] like Figure 1 FIG. 1 is a flow chart of an intrusion detection method based on network traffic data provided by an embodiment of the present invention. The intrusion detection method based on network traffic data includes:

[0054] Step S1: Acquire network traffic data corresponding to the current time period; wherein the network traffic data includes: transmission data, source data corresponding to the data packet sender, and destination data corresponding to the data packet receiver;

[0055] Step S2: converting the network traffic data into a corresponding graph structure for representing the transmission relationship between each node; wherein the nodes in the graph structure include: a source node and a destination node;

[0056] Step S3: Inputting the graph structure into a preset intrusion detection model, so that the intrusion detection model performs weighted aggregation based on the source node vector, destination node vector, and connection edge vectors between nodes extracted from the graph structure, and then concatenates the weighted aggregated vectors to generate edge features for characterizing the transmission relationship between nodes, and generates the network intrusion type corresponding to the graph structure based on each edge feature;

[0057] The training of the preset intrusion detection model includes:

[0058] Taking several network traffic data samples and the actual network intrusion type corresponding to each network traffic data sample as input, and the predicted network intrusion type of each network traffic data sample as output, the intrusion detection model to be trained is iteratively trained until the model converges to generate a preset intrusion detection model.

[0059] For step S1, the present invention can obtain the network traffic data corresponding to the system in the current time period, and thus identify the corresponding network intrusion type based on the network traffic data in real time. Therefore, the present invention can realize the discrimination of the network intrusion type.

[0060] Network traffic data includes transmission data, source data corresponding to the data packet sender, and destination data corresponding to the data packet receiver.

[0061] By acquiring network traffic data, we can not only focus on the transmission data corresponding to the current time period, but also on the sender (source data) and receiver (destination data) of the data, thus providing a more complete and accurate understanding of network behavior. Moreover, by using source and destination data, the present invention can more accurately track and analyze the flow of data packets in the network, thereby more accurately determining whether there are anomalies or intrusions.

[0062] For step S2, in a preferred embodiment, before the present invention determines the attack type of the network traffic data, it can first convert the network traffic data into a corresponding graph structure for characterizing the transmission relationship between each node, and the graph structure includes several source nodes and destination nodes, and there are corresponding connection edges between the source nodes and the destination nodes.

[0063] In a preferred embodiment, the source data includes a source IP address and a source port number; the destination data includes a destination IP address and a destination port number;

[0064] Each source data packet corresponds to a transmission data, and the transmission data includes the source sender of the data packet, the receiver of the data packet, the data packet type, the transmission rate and the data transmission protocol;

[0065] When converting the network traffic data into a corresponding graph structure for representing the transmission relationship between each node, the specific process is as follows:

[0066] For each source data packet, generating a first two-tuple identifier corresponding to the source sender according to the source IP address and the source port; wherein each first two-tuple identifier corresponds to a piece of transmission data;

[0067] For each destination data packet, generating a second two-tuple identifier corresponding to the recipient according to the destination IP address and the destination port number;

[0068] The source sender is regarded as the source node in the graph structure and the receiver is regarded as the destination node in the graph structure. Then, according to each tuple identifier and each transmission data, each source node and each destination node are connected to generate a graph structure for representing the transmission relationship between each node;

[0069] The data corresponding to the connection edge in the graph structure is: the transmission data corresponding to the first two-tuple identifier; the connection edge is an edge connecting a source node and a corresponding destination node.

[0070] Specifically, the network traffic data is first cleaned to remove incomplete data records such as Nan and Infinity to improve the quality of the data set; and the label encoding method is used to convert the non-numerical features in the network traffic data into numerical features, and the data features are normalized to ensure that all features are in the same dimension.

[0071] Then, the network traffic data is modeled as a graph structure, in which the source node is identified by a tuple consisting of the source IP address and the source port, the destination node is identified by a tuple consisting of the destination IP address and the destination port, and the remaining flow fields serve as features of the edges related to the two connected nodes.

[0072] The graph structure can be represented by G, G = (V, E, XV, XE), where V represents the node set, E represents the edge set, XV represents the node feature matrix, and XE represents the edge feature matrix. The present invention can then transform the network intrusion detection problem into a classification problem based on edge features in the graph. This means that the type of intrusion behavior can be determined by analyzing the features of each edge in the graph.

[0073] By generating a graph structure, this method can effectively adapt to different types of network traffic data, representing both simple packet transmission and complex network interactions. Furthermore, by converting network traffic data into a graph structure, a graph neural network-based intrusion detection model can be used to perform rapid and accurate intrusion detection, improving detection efficiency.

[0074] In the process of generating the graph structure, the present invention can determine the source sender based on each source data packet and use the source sender as the source node in the graph structure, and determine the receiver based on the destination data packet and use the receiver as the destination node in the graph structure;

[0075] Furthermore, the source node and the destination node in the graph structure can be determined based on the generated binary identifier. Since the source node corresponds to a source sender, or the destination node corresponds to a receiver, and the transmission data contains the source sender and the receiver of the data packet, the transmission data corresponding to the node can be queried through the source node or the destination node, and then the node to be connected to the node can be found based on the transmission data. The two nodes can be connected based on the transmission data, and the transmission data can be used as the data of the current connection edge to obtain the data characteristics corresponding to the connection edge. Alternatively, the two nodes can be connected based on the identifier corresponding to the source node or the destination node and the corresponding transmission data.

[0076] In an embodiment of the present invention, the second two-tuple identifier corresponding to the first two-tuple identifier can be found based on the transmission data corresponding to the first two-tuple identifier, so that the nodes corresponding to the two two-tuple identifiers are connected, and the data characteristics corresponding to the connection (such as data packet type, transmission rate and data transmission protocol) are generated based on the corresponding transmission data.

[0077] It can be understood that in actual network traffic, a node (i.e., a combination of IP address + port number) can be both the sender and the receiver of data, and a node can be both the source node and the destination node. The node can correspond to different binary identifiers at the same time to distinguish whether it is a source node or a destination node, and connect to other nodes through corresponding transmission data, thereby generating different connection edges based on different transmission data.

[0078] Specifically, the present invention can clearly distinguish the identity of a node in different transmission scenarios by allocating different binary identifiers to a node.

[0079] When this node is the source sender, it acts as a source node. Assuming the source node's IP address is 192.168.1.200 and port number is 8080, it sends data to another destination node, whose binary identifier is (192.168.1.100,

[5000] ). In the graph structure, the source node (192.168.1.200,

[8080] ) points to the destination node (192.168.1.100,

[5000] ) through an edge. This edge carries relevant transmission data, such as the type, size, timestamp, and protocol of the transmitted packet.

[0080] When this node is the receiver, it serves as the destination node. The destination node's IP address is 192.168.1.300 and port number is 9090. It receives data from another source node, whose binary identifier is (192.168.1.100,

[6000] ). In the graph structure, the destination node (192.168.1.300,

[9090] ) is pointed to by an edge from the source node (192.168.1.100,

[6000] ), and this new edge also contains the relevant transmission data.

[0081] The present invention uses a binary identifier consisting of the source IP address, source port number, destination IP address, and destination port number to accurately identify each sender and receiver in network traffic, ensuring that the nodes and edges in the graph structure fully reflect the actual network traffic. Directly connecting nodes based on binary identifiers and transmission data avoids tedious data matching and conversion processes, further improving the efficiency of graph generation.

[0082] Illustratively, the graph structure of the present invention can flexibly adapt to different types of network traffic data and different analysis requirements. For example, nodes and connecting edges can be added or deleted as needed, or data features can be adjusted to meet specific analysis or detection requirements.

[0083] Regarding step S3, in a preferred embodiment, the embodiment of the present invention can input the converted graph structure into a preset intrusion detection model to automatically identify the corresponding network intrusion type.

[0084] Schematically, the intrusion detection model of an embodiment of the present invention is a neural network model based on a graph edge attention mechanism, which may be a graph neural network (GNN), which can effectively utilize network topology information and combine node and edge features to capture potential information in the data.

[0085] During the training of the intrusion detection model, the present invention can input a network traffic data sample into the intrusion detection model during each iterative training, so that the intrusion detection model generates a prediction result of the network intrusion type corresponding to the network traffic data sample based on the edge features corresponding to the network traffic data sample;

[0086] The network intrusion type prediction result is compared with the actual network intrusion type, and the network parameters of the intrusion detection model are adjusted according to the comparison result.

[0087] Furthermore, in a preferred embodiment, the present invention may further include the following process when iteratively training the intrusion detection model to be trained:

[0088] The parameters of the intrusion detection model are updated according to the following loss function formula:

[0089]

[0090] in, is the prediction error corresponding to the intrusion detection model, N represents the total number of network traffic data samples, M represents the total number of network intrusion types, and β m is the weight factor of network intrusion type m, which is used to balance the importance of each network intrusion type, y nmrepresents the probability of the actual network intrusion type m corresponding to the network traffic data sample n, is the probability of predicting network intrusion type m in network traffic data sample n, is an adjustment factor used to reduce the weight of easy-to-classify samples.

[0091] It is understandable that in order to cope with the situation where there are only a few class samples in the model training process, the focal loss function is adopted, so that the model focuses on the minority class samples in the data set during training to improve the model classification performance, retaining the characteristics of the cross entropy loss. The focal loss function formula is as follows:

[0092]

[0093] Furthermore, the present invention can also set the adjustment factor γ and the weight factor β m Usually, γ is set to

[0094] Set to 2, β m The calculation formula is as follows:

[0095]

[0096] Among them, number m is the number of samples of category m, sum total is the total number of samples in the training set.

[0097] The embodiment of the present invention adopts a multi-layer perceptron (MLP) network for classification and improves the problem of sample imbalance through the focal loss function (FocalLoss), so that more attention can be paid to a smaller number of samples during model training, thereby improving the model's recognition ability for small sample categories, making the model more robust and reliable, and thus improving the model classification performance.

[0098] like Figure 2 The flowchart of the intrusion detection model training shown in the figure shows that the embodiment of the present invention can perform data cleaning, label encoding and normalization on the collected network traffic, and convert the processed traffic data into a graph structure to generate a network traffic graph structure; and use the multi-head edge attention mechanism through the intrusion detection model to calculate the attention coefficient of each node in the network traffic graph structure, perform weighted aggregation on the node features, and update the edge embedding;

[0099] The updated edge embedding is input into the multi-layer perceptron network, and the weights of easy-to-classify and difficult-to-classify samples are continuously adjusted through the focal loss function to optimize the model; finally, the trained model is used to perform classification prediction on new network traffic data, and the prediction results are compared with the true labels to evaluate the model performance.

[0100] During model training, the Adam optimizer can be used for gradient descent in the back-propagation phase, with a learning rate set to 0.001 and a focal loss function. The dataset is divided into a training set and a test set in a ratio of 3:1. This embodiment of the present invention can also enhance the model's classification performance, generalization ability, and accuracy by setting a series of hyperparameters for model training.

[0101] Schematically, a trained intrusion detection model includes: feature extraction layer, graph edge attention layer and classification layer;

[0102] After the graph structure is input into the intrusion detection model, the feature extraction layer in the intrusion detection model is used to extract a plurality of source node vectors, a plurality of destination node vectors, and a plurality of connection edge vectors between nodes according to each first two-tuple identifier, each second two-tuple identifier, and the transmission data corresponding to each first two-tuple identifier in the graph structure;

[0103] The graph edge attention layer in the intrusion detection model is used to perform weighted aggregation on each source node vector, the source node vector, the destination node vector corresponding to the source node vector, and the connection edge vector corresponding to the source node vector to generate a weighted aggregated source node vector corresponding to the source node vector;

[0104] The classification layer in the intrusion detection model is used to splice the source node vectors after weighted aggregation to generate a number of edge features for characterizing the transmission relationship between nodes; and generate the network intrusion type corresponding to the graph structure according to each edge feature.

[0105] Among them, based on the source node vectors, destination node vectors and connection edge vectors extracted by the feature extraction layer, the embodiment of the present invention can obtain the weighted aggregated source node vector corresponding to each source node vector through the graph edge attention layer, that is, after calculating the attention coefficient of each edge through the attention mechanism, the source node vectors can be aggregated according to the attention coefficient of each edge (that is, the connection edge) to obtain the aggregated node embedding, that is, the weighted aggregated source node vector corresponding to each source node vector is generated.

[0106] The processing process of the graph edge attention layer is:

[0107] The graph edge attention layer is used to generate an attention coefficient for each connection edge through an attention mechanism based on each source node vector, the destination node vector corresponding to each source node vector, and the connection edge vector corresponding to each source node vector;

[0108] For each connection edge, normalize the attention coefficient to generate a normalized attention coefficient;

[0109] For each source node vector, based on the corresponding normalized attention coefficient, the source node vector, the destination node vector corresponding to the source node vector, and the connection edge vector corresponding to the source node vector are weightedly aggregated to generate a weighted aggregated source node vector.

[0110] Schematically, the graph edge attention layer of the present invention can concatenate the embeddings of the source and destination nodes of the previous layer with the embeddings of the connected edges, and calculate the attention coefficient of each edge through the attention mechanism, as follows:

[0111]

[0112] Where, and Represents node i and edge e respectively ij and the embedding of node j at layer k-1, || represents the concatenation operation of two vectors, W k is the weight matrix of the current layer k for the linear transformation of the input, is a feed-forward neural network.

[0113] The attention coefficient obtained above is normalized to obtain the normalized attention coefficient, which is performed using the softmax function. The normalized attention coefficient is calculated according to the following formula:

[0114]

[0115] Therefore, the normalized attention coefficient can be used to aggregate node i to obtain the aggregated node embedding, that is, the weighted aggregated source node vector

[0116] In a preferred embodiment, the graph edge attention layer includes several attention layers, each attention layer includes several attention heads; each attention head corresponds to an attention coefficient;

[0117] When generating the weighted aggregated source node vector, the following steps are specifically included:

[0118] For each attention layer in the graph edge attention layer, the attention layer calculates the weighted aggregated source node vector according to the following formula:

[0119]

[0120] in, is the weighted aggregated source node vector of the current attention layer, is the normalized attention coefficient corresponding to the t-th attention head of the current attention layer, is the weight matrix of the t-th attention head, is the source node vector of source node i in the previous attention layer, is the connection edge vector of source node i in the previous attention layer, e ij represents the connection edge between source node i and destination node j, is the destination node vector corresponding to the source node i in the previous attention layer, σ represents the scaling factor of the current attention layer, T represents the number of attention heads in the current attention layer, N i Indicates the total number of destination nodes connected to source node i.

[0121] Furthermore, the classification layer concatenates the weighted aggregated source node vectors to generate several edge features used to characterize the transmission relationship between nodes. Specifically, the embeddings of node i and node j can be concatenated to generate the final edge embedding, as shown in the following formula:

[0122]

[0123] in, is the edge feature used to characterize the transmission relationship between nodes.

[0124] Furthermore, the present invention adopts a multi-layer perceptron MLP network to perform multi-classification tasks, embedding the edge As input features, it is input into the MLP network, and after calculations in multiple hidden layers, the classification results are finally output. The formula is as follows:

[0125]

[0126] in, Represents the category probability vector predicted by the model.

[0127] Schematically, the feature extraction layer of the present invention extracts the node vectors and edge vectors in the graph based on the nodes in the graph structure and the edge representing the association relationship between the nodes, thereby obtaining a feature representation of the entire graph structure and capturing the interaction and mutual influence between the nodes, thereby providing a deeper understanding of the intrinsic characteristics of network traffic.

[0128] Furthermore, the graph edge attention layer of the present invention employs a design with multiple attention heads. Each attention head can independently calculate attention coefficients and perform weighted aggregation, enabling the model to capture a variety of different interaction patterns in the network, improving recognition accuracy and comprehensiveness. Furthermore, the use of multiple attention heads increases the model's capacity, enabling the present invention to handle more complex network structures and traffic patterns.

[0129] Finally, a multi-layer perceptron (MLP) network is used for multi-classification tasks, which can make full use of the information in the edge features and gradually abstract higher-level feature representations through calculations in multiple hidden layers, thereby improving the accuracy of attack classification and the ability to detect unknown network attacks, and can effectively identify potential abnormal behaviors or attack patterns.

[0130] like Figure 3 As shown, based on the above-mentioned various embodiments of the intrusion detection method based on network traffic data, the present invention provides corresponding device embodiments;

[0131] An embodiment of the present invention provides an intrusion detection device based on network traffic data, comprising: a network traffic data acquisition module, a graph structure conversion module, and a network intrusion type generation module;

[0132] The network traffic data acquisition module is used to acquire network traffic data corresponding to the current time period; wherein the network traffic data includes: transmission data, source data corresponding to the data packet sender, and destination data corresponding to the data packet receiver;

[0133] The graph structure conversion module is used to convert the network traffic data into a corresponding graph structure for representing the transmission relationship between each node; wherein the nodes in the graph structure include: a source node and a destination node;

[0134] The network intrusion type generation module is used to input the graph structure into a preset intrusion detection model, so that the intrusion detection model performs weighted aggregation based on the source node vector, destination node vector, and connection edge vectors between nodes extracted from the graph structure, and then splices each weighted aggregated vector to generate edge features for characterizing the transmission relationship between nodes, and generates the network intrusion type corresponding to the graph structure based on each edge feature;

[0135] The training of the preset intrusion detection model includes:

[0136] Taking several network traffic data samples and the actual network intrusion type corresponding to each network traffic data sample as input, and the predicted network intrusion type of each network traffic data sample as output, the intrusion detection model to be trained is iteratively trained until the model converges to generate a preset intrusion detection model.

[0137] It should be noted that the device embodiments described above are merely illustrative, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, and may be located in one place or distributed across multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. In addition, in the drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art can understand and implement the present invention without paying any creative effort.

[0138] Those skilled in the art can clearly understand that, for the sake of convenience and brevity, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0139] Based on the above-mentioned various embodiments of the intrusion detection method based on network traffic data, the present invention provides corresponding embodiments of terminal equipment items.

[0140] An embodiment of the present invention provides a terminal device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements an intrusion detection method based on network traffic data as described in any method embodiment of the present invention.

[0141] The terminal device may be a computing terminal device such as a desktop computer, a notebook computer, a palmtop computer, a cloud server, etc. The terminal device may include, but is not limited to, a processor and a memory.

[0142] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the terminal device, connecting various parts of the entire terminal device using various interfaces and lines.

[0143] The memory can be used to store the computer program, and the processor implements various functions of the terminal device by running or executing the computer program stored in the memory and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created based on the use of the mobile phone, etc. In addition, the memory can include a high-speed random access memory and can also include a non-volatile memory, such as a hard disk, internal memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device or other volatile solid-state storage device.

[0144] Based on the above-mentioned various embodiments of the intrusion detection method based on network traffic data, the present invention provides corresponding embodiments of storage media items.

[0145] An embodiment of the present invention provides a storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute an intrusion detection method based on network traffic data as described in any method embodiment of the present invention.

[0146] The storage medium is a computer-readable storage medium, and the computer program is stored in the computer-readable storage medium. When the computer program is executed by the processor, it can implement the steps of the above-mentioned various method embodiments. The computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device that can carry the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0147] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for intrusion detection based on network traffic data, characterized in that: include: Obtaining network traffic data corresponding to the current time period; wherein the network traffic data includes: transmission data, source data corresponding to the data packet sender, and destination data corresponding to the data packet receiver; Converting the network traffic data into a corresponding graph structure for representing the transmission relationship between each node; wherein the nodes in the graph structure include: a source node and a destination node; Inputting the graph structure into a preset intrusion detection model, so that the intrusion detection model performs weighted aggregation based on the source node vector, the destination node vector, and the connection edge vectors between the nodes extracted from the graph structure, and then splicing the weighted aggregated vectors to generate edge features for characterizing the transmission relationship between the nodes, and generating the network intrusion type corresponding to the graph structure based on the edge features; The training of the preset intrusion detection model includes: Taking a number of network traffic data samples and the actual network intrusion type corresponding to each network traffic data sample as input, and the predicted network intrusion type of each network traffic data sample as output, the intrusion detection model to be trained is iteratively trained until the model converges, thereby generating a preset intrusion detection model; The intrusion detection model includes: a graph edge attention layer; the graph edge attention layer includes several attention layers, each attention layer includes several attention heads; an attention coefficient corresponding to each attention head; The graph edge attention layer is used to generate an attention coefficient for each connection edge through an attention mechanism based on each source node vector, the destination node vector corresponding to each source node vector, and the connection edge vector corresponding to each source node vector; For each connection edge, normalize the attention coefficient to generate a normalized attention coefficient; For each source node vector, based on the corresponding normalized attention coefficient, perform weighted aggregation on the source node vector, the destination node vector corresponding to the source node vector, and the connection edge vector corresponding to the source node vector to generate a weighted aggregated source node vector; For each attention layer in the graph edge attention layer, the attention layer calculates the weighted aggregated source node vector according to the following formula: ； in, is the weighted aggregated source node vector of the current attention layer, is the normalized attention coefficient corresponding to the t-th attention head of the current attention layer, is the weight matrix of the t-th attention head, Source node The source node vector in the previous attention layer, Source node The connection edge vector in the previous attention layer, Represents the source node With the destination node The connecting edges between Source node The destination node vector corresponding to the previous attention layer, represents the scaling factor of the current attention layer, Indicates the number of attention heads in the current attention layer, Represents the source node The total number of destination nodes to which connections exist.

2. The intrusion detection method based on network traffic data according to claim 1, characterized in that: The source data includes a source IP address and a source port number; the destination data includes a destination IP address and a destination port number; each source data packet corresponds to a transmission data; the transmission data includes the source sender of the data packet, the receiver of the data packet, the data packet type, the transmission rate, and the data transmission protocol; The converting the network traffic data into a corresponding graph structure for representing the transmission relationship between each node includes: For each source data packet, generating a first two-tuple identifier corresponding to the source sender according to the source IP address and the source port; wherein each first two-tuple identifier corresponds to a piece of transmission data; For each destination data packet, generating a second two-tuple identifier corresponding to the recipient according to the destination IP address and the destination port number; The source sender is taken as the source node in the graph structure and the receiver is taken as the destination node in the graph structure. Then, according to each binary identifier and each transmission data, each source node and each destination node are connected to generate a graph structure for characterizing the transmission relationship between each node; wherein the data corresponding to the connection edge in the graph structure is: the transmission data corresponding to the first binary identifier; the connection edge is the edge connecting a source node and a corresponding destination node.

3. The intrusion detection method based on network traffic data according to claim 2, characterized in that: The intrusion detection model further includes: a feature extraction layer and a classification layer; The feature extraction layer in the intrusion detection model is used to extract a plurality of source node vectors, a plurality of destination node vectors, and a plurality of connection edge vectors between nodes based on each first two-tuple identifier, each second two-tuple identifier, and the transmission data corresponding to each first two-tuple identifier in the graph structure; The classification layer in the intrusion detection model is used to splice the source node vectors after weighted aggregation to generate a number of edge features for characterizing the transmission relationship between nodes; and generate the network intrusion type corresponding to the graph structure according to each edge feature.

4. The intrusion detection method based on network traffic data according to claim 1, characterized in that: During each iterative training, a network traffic data sample is input into the intrusion detection model, so that the intrusion detection model generates a prediction result of the network intrusion type corresponding to the network traffic data sample based on the edge features corresponding to the network traffic data sample; The network intrusion type prediction result is compared with the actual network intrusion type, and the network parameters of the intrusion detection model are adjusted according to the comparison result.

5. The intrusion detection method based on network traffic data according to claim 1, characterized in that: When iteratively training the intrusion detection model to be trained, it also includes: The parameters of the intrusion detection model are updated according to the following loss function formula: ； in, is the prediction error corresponding to the intrusion detection model, Represents the total number of network traffic data samples, Indicates the total number of network intrusion types, Network intrusion type The weight factor is used to balance the importance of each network intrusion type. Represents a sample of network traffic data Corresponding type The probability of actual network intrusion type, A sample of network traffic data Medium type The probability of predicting network intrusion types, is an adjustment factor used to reduce the weight of easy-to-classify samples.

6. An intrusion detection device based on network traffic data, characterized in that: The intrusion detection method based on network traffic data according to any one of claims 1 to 5 comprises: a network traffic data acquisition module, a graph structure conversion module, and a network intrusion type generation module; The network traffic data acquisition module is used to acquire network traffic data corresponding to the current time period; wherein the network traffic data includes: transmission data, source data corresponding to the data packet sender, and destination data corresponding to the data packet receiver; The graph structure conversion module is used to convert the network traffic data into a corresponding graph structure for representing the transmission relationship between each node; wherein the nodes in the graph structure include: a source node and a destination node; The network intrusion type generation module is used to input the graph structure into a preset intrusion detection model, so that the intrusion detection model performs weighted aggregation based on the source node vector, destination node vector, and connection edge vectors between nodes extracted from the graph structure, and then splices each weighted aggregated vector to generate edge features for characterizing the transmission relationship between nodes, and generates the network intrusion type corresponding to the graph structure based on each edge feature; The training of the preset intrusion detection model includes: Taking several network traffic data samples and the actual network intrusion type corresponding to each network traffic data sample as input, and the predicted network intrusion type of each network traffic data sample as output, the intrusion detection model to be trained is iteratively trained until the model converges to generate a preset intrusion detection model.

7. A terminal device, characterized in that: The invention comprises a processor, a memory and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the intrusion detection method based on network traffic data as described in any one of claims 1 to 5 is implemented.

8. A storage medium, characterized in that: The storage medium includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the intrusion detection method based on network traffic data according to any one of claims 1 to 5.

Images