Malicious encrypted traffic detection method and system based on twin map encoder

Abstract

The invention provides a malicious encrypted traffic detection method and system based on a twin map encoder, and belongs to the technical field of network privacy protection, and the method comprises the steps: obtaining a to-be-detected encrypted traffic packet; and using a pre-trained detection model to detect whether the obtained to-be-detected encrypted traffic packet is a detection result of a malicious encrypted traffic packet. According to the modeling method based on co-occurrence graph and word frequency graph fusion, modeling is conducted on the header part and the payload part of a traffic packet from the byte level, the global attention mechanism is used for fusing the characteristics of traffic byte graph nodes to obtain final graph embedding representation, then hidden characteristics of malicious and normal encrypted traffic can be fully mined, and therefore the hidden characteristics of the malicious and normal encrypted traffic can be fully mined. And malicious encrypted traffic can be detected efficiently and accurately.

Description

Technical Field

[0001] The present invention relates to the technical field of network privacy protection, and in particular to a malicious encrypted traffic detection method and system based on a twin graph encoder. Background Art

[0002] In order to protect the privacy of users, traffic in the network is usually transmitted after encryption. Encryption technologies such as TLS and network anonymity technologies such as VPN and Tor are widely used. Traditional traffic analysis methods include port-based technology and deep packet inspection methods, which use specific rules to filter and identify traffic. Port-based traffic analysis methods determine the type of traffic by port. Now the network environment is complex and changeable, and network services are gradually using dynamic port allocation and non-standard interfaces, which makes these methods unable to accurately and effectively identify traffic types. Deep packet inspection technology is based on prior knowledge and extracts keywords and patterns from the payload part of the traffic packet to classify the traffic. However, the payload part of the encrypted traffic is ciphertext, which greatly reduces the availability of deep packet inspection technology.

[0003] To address these issues, learning-based methods were introduced into encrypted traffic identification. Initial machine learning algorithms such as random forests and support vector machines relied on manually constructed statistical features and lacked stability. Subsequently, deep learning methods such as convolutional neural networks and recurrent neural networks learned encrypted traffic features through packet size sequences, but did not fully utilize the original information. Therefore, methods based on pre-trained models were introduced, which use raw byte information as input and are divided into language model-based and image model-based methods according to different models. However, these methods are complex and do not effectively distinguish between the header and payload features of traffic, introduce noise, and affect efficiency. Graph learning methods have also been introduced due to their ability to extract relational features, but the existing methods have a single modeling method, fail to fully extract raw byte features, have complex models, and do not focus on malicious encrypted traffic detection.

[0004] In summary, in the existing technology, network traffic is usually transmitted after encryption, and network anonymity technology is widely used. Although encrypted traffic protects user privacy, it can be maliciously exploited by attackers to hide attack behaviors. After the traffic is encrypted, key information such as payload cannot be directly parsed, and traffic feature extraction is more difficult. It is challenging to detect malicious encrypted traffic from complex network traffic. Summary of the invention

[0005] The purpose of the present invention is to provide a malicious encrypted traffic detection method and system based on a twin graph encoder to solve at least one technical problem existing in the above-mentioned background technology.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] In a first aspect, the present invention provides a method for detecting malicious encrypted traffic based on a twin graph encoder, comprising:

[0008] Obtain the encrypted traffic packet to be detected;

[0009] A pre-trained detection model is used to detect whether the encrypted traffic packet to be detected is a malicious encrypted traffic packet detection result; wherein, the training of the detection model includes: constructing the original byte graph of the encrypted traffic packet: dividing the traffic packet into two parts, a header and a load, represented by the original bytes, extracting the features of the original bytes, and establishing a co-occurrence graph and a word frequency graph for the header and the load respectively; a twin graph encoder: an attention-based feature fusion module fuses the embedding vectors of the header and the load to obtain the final embedding representation of the traffic packet; attention feature fusion: using the global attention mechanism to aggregate the node feature representations of the header and the load graph to obtain the feature representation of the entire graph; wherein, the global attention aggregation mechanism assigns different attention weights to the relationship between nodes, so that the model can pay more attention to important nodes and their features, thereby obtaining more accurate graph features; the obtained two parts of the graph feature vectors are spliced ​​and input into the linear layer for transformation to obtain the final encrypted traffic packet feature representation.

[0010] Furthermore, in the construction of the co-occurrence graph, the original bytes of the header or payload of an encrypted traffic packet are represented as s. In order to extract the correlation features between different bytes in the packet, the co-occurrence matrix is ​​used to construct the corresponding co-occurrence graph G for s. o =(V o ,E o ,X o );V o is a node set, each byte contained in s corresponds to a node, X o is the feature set of the node; process s with a sliding window of fixed size, and construct the co-occurrence edges between the bytes that co-occur in the co-occurrence window W; for s, first use the sliding window to construct the byte co-occurrence matrix A, and use A as G o The adjacency matrix of .

[0011] Furthermore, in the construction of the word frequency graph, by constructing the word frequency graph G f =(V f ,E f ,X f ) to extract frequency features; each node in the word frequency graph represents a byte in s, and the edge is a self-loop, X f is the node feature; for the feature of node i, the frequency f of i is used i and the original byte n i Indicates its characteristics, n i Perform one-hot encoding in [0-255] to get the vector Then multiply the frequency and the original byte feature to get the final feature representation

[0012] Furthermore, graph fusion and node embedding are performed. After obtaining the co-occurrence graph and word frequency graph representation of the head and the payload, the co-occurrence graph G o and word frequency graph G f Fusion is performed to obtain a unified graph representation G F =(V F ,E F ,X F ), and then update the embedding representation of the byte node; the nodes in the co-occurrence graph and the word frequency graph are all bytes, and the graph fusion operation is mainly divided into two parts: edge fusion and node feature fusion; the co-occurrence graph G o The adjacency matrix A o and word frequency graph G f The adjacency matrix A f The sum is the adjacency matrix A of the fusion graph F ; The node feature fusion process processes the node embedding representation in the co-occurrence graph and the word frequency graph, and obtains the new node representation X through multiplication operation F =X o ×X f ; The node embedding process updates the node representation to the fused node representation.

[0013] Furthermore, the twin graph encoder consists of two graph encoders with the same model structure but no shared parameters, which can process the graph structure data of the header and the load in parallel; in order to encode the graph composed of traffic packets into a feature vector, the graph encoder is composed of two stacked GraphSAGE modules. GraphSAGE is a graph neural network that can accurately extract graph structure features; for each node in the graph, GraphSAGE first uses the degree of the target node to normalize the embedding vectors of all neighboring nodes; then GraphSAGE concatenates the embedding vectors of the target vertex and the neighboring vertices, and calculates the mean of each dimension of the vector; finally, a nonlinear transformation is performed on the generated new embedding vector of the target node to complete a forward propagation of GraphSAGE.

[0014] Furthermore, the information transmission and aggregation process of GraphSAGE can be formally described as follows:

[0015]

[0016] Where N(v) is the set of neighboring nodes of the target node v, |N(v)| is the number of neighboring nodes, and w (l)is the parameter in layer l, CONCAT(·) represents the concatenation operation, and σ(·) represents the activation function. The ReLU activation function is used to process the output of GraphSAGE to increase the nonlinear relationship between the layers of the network. Finally, the batch normalization layer is used to transform the updated feature vector Normalization.

[0017] Furthermore, after obtaining the new node feature representation through the graph encoder, feature aggregation based on the attention mechanism is performed, including: first, using the global attention mechanism to aggregate the node feature representation of the head and load graphs to obtain the feature representation of the entire graph; the global attention aggregation mechanism assigns different attention weights to the relationship between nodes, focusing on important nodes and their features, so as to obtain more accurate graph features:

[0018]

[0019] where f gate (·) is the neural network that calculates the attention score of each feature, and sets f gate (·) as a linear layer, N is the number of nodes in the graph, x k is the feature of the kth node. Then, the node features of the input header graph and payload graph are added to f attation-pooling (·) to obtain a graphical representation;

[0020] Then the two parts of the graph feature vectors are concatenated and input into the linear layer for transformation to obtain the final encrypted traffic packet feature representation:

[0021] F final =CONCAT(F header ,F payload ).

[0022] In a second aspect, the present invention provides a malicious encrypted traffic detection system based on a twin graph encoder, comprising:

[0023] An acquisition module, used to acquire the encrypted traffic packet to be detected;

[0024] A detection module is used to use a pre-trained detection model to detect whether the encrypted traffic packet to be detected is a malicious encrypted traffic packet; wherein, training the detection model includes: constructing the original byte graph of the encrypted traffic packet: dividing the traffic packet into two parts, a header and a load, represented by the original bytes, extracting the features of the original bytes, and establishing a co-occurrence graph and a word frequency graph for the header and the load respectively; a twin graph encoder: an attention-based feature fusion module fuses the embedding vectors of the header and the load to obtain the final embedding representation of the traffic packet; attention feature fusion: using a global attention mechanism to aggregate the node feature representations of the header and the load graph to obtain the feature representation of the entire graph; wherein the global attention aggregation mechanism assigns different attention weights to the relationship between nodes, so that the model can pay more attention to important nodes and their features, thereby obtaining more accurate graph features; the obtained two-part graph feature vectors are spliced ​​and input into the linear layer for transformation to obtain the final encrypted traffic packet feature representation.

[0025] In a third aspect, the present invention provides a non-transitory computer-readable storage medium, which is used to store computer instructions. When the computer instructions are executed by a processor, the malicious encrypted traffic detection method based on the twin graph encoder as described in the first aspect is implemented.

[0026] In a fourth aspect, the present invention provides a computer device comprising a memory and a processor, wherein the processor and the memory communicate with each other, the memory stores program instructions executable by the processor, and the processor calls the program instructions to execute the malicious encrypted traffic detection method based on the twin graph encoder as described in the first aspect.

[0027] In a fifth aspect, the present invention provides an electronic device, comprising: a processor, a memory, and a computer program; wherein the processor is connected to the memory, and the computer program is stored in the memory. When the electronic device is running, the processor executes the computer program stored in the memory so that the electronic device executes instructions for implementing the malicious encrypted traffic detection method based on the twin graph encoder as described in the first aspect.

[0028] Beneficial effects of the present invention: Based on the modeling method of the fusion of co-occurrence graph and word frequency graph, the header and payload parts of the traffic packet are modeled separately at the byte level, and the features of the traffic byte graph nodes are fused using the global attention mechanism to obtain the final graph embedding representation, thereby fully mining the hidden features of malicious and normal encrypted traffic, and efficiently and accurately detecting malicious encrypted traffic.

[0029] Additional advantages of the present invention will be more clearly presented in the following description or learned through the practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0031] Figure 1 This is a flow chart of a malicious encrypted traffic detection method based on a twin graph encoder according to an embodiment of the present invention.

[0032] Figure 2 The figure is a schematic diagram of the fusion process of the co-linear graph and the word frequency graph according to an embodiment of the present invention. DETAILED DESCRIPTION

[0033] The embodiments of the present invention are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements with the same or similar functions. The embodiments described below by the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be interpreted as limiting the present invention.

[0034] It should be understood by those skilled in the art that unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those skilled in the art to which this invention belongs.

[0035] It should also be understood that terms, such as those defined in commonly used dictionaries, should be understood to have a meaning consistent with that in the context of the prior art and will not be interpreted in an idealized or overly formal sense unless as defined herein.

[0036] Those skilled in the art will appreciate that, unless otherwise stated, the singular forms "a", "an", "said" and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present invention refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements and / or groups thereof.

[0037] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. Different embodiments or examples described in this specification and features of different embodiments or examples may be combined and combined by those skilled in the art without contradiction.

[0038] To facilitate understanding of the present invention, the present invention is further explained below with reference to specific embodiments in conjunction with the accompanying drawings, and the specific embodiments do not constitute a limitation on the embodiments of the present invention.

[0039] Those skilled in the art should understand that the drawings are merely schematic diagrams of embodiments, and the components in the drawings are not necessarily necessary for implementing the present invention.

[0040] The present invention provides a malicious encrypted traffic detection method based on a twin graph encoder, which respectively establishes a co-occurrence graph and a word frequency graph according to the byte information of the header and payload of the encrypted traffic, obtains the final encrypted traffic graph representation through node embedding and graph fusion mechanism, and then performs end-to-end malicious encrypted traffic detection. This method is based on a twin graph encoder of graph convolution, which uses graph convolution and global attention mechanism to obtain the embedding representation of the header and payload graphs respectively, obtains the vector representation of the encrypted traffic efficiently and accurately through the designed feature fusion module, and finally inputs the malicious encrypted traffic detection module. At present, in order to protect user privacy, traffic is usually transmitted in the network in the form of ciphertext. Although encrypted traffic protects user privacy, it is maliciously used by attackers to hide attack behaviors. After the traffic is encrypted, key information such as payload cannot be directly parsed, and traffic feature extraction is more difficult. It is challenging to detect malicious encrypted traffic from complex network traffic. Designing an accurate malicious traffic modeling method and mining potential hidden features to obtain accurate encrypted traffic representation are still two major difficult technical problems. This method mainly solves the difficulty of modeling malicious traffic and mining hidden features of encrypted traffic. It can fully mine the hidden features of malicious and normal encrypted traffic and detect malicious encrypted traffic efficiently and accurately.

[0041] Example 1

[0042] In this embodiment 1, a malicious encrypted traffic detection system based on a twin graph encoder is first provided, including: an acquisition module, used to obtain an encrypted traffic packet to be detected; a detection module, used to use a pre-trained detection model to detect whether the acquired encrypted traffic packet to be detected is a detection result of a malicious encrypted traffic packet; wherein, training the detection model includes: constructing the original byte graph of the encrypted traffic packet: dividing the traffic packet into two parts, a header and a load represented by original bytes, extracting the features of the original bytes, and establishing a co-occurrence graph and a word frequency graph for the header and the load respectively; a twin graph encoder: an attention-based feature fusion module fuses the embedding vectors of the header and the load to obtain the final embedding representation of the traffic packet; attention feature fusion: using a global attention mechanism to aggregate the node feature representations of the header and the load graph to obtain the feature representation of the entire graph; wherein, the global attention aggregation mechanism assigns different attention weights to the relationship between nodes, so that the model can pay more attention to important nodes and their features, thereby obtaining more accurate graph features; the obtained two parts of the graph feature vectors are spliced ​​and input into the linear layer for transformation to obtain the final encrypted traffic packet feature representation.

[0043] In this embodiment, the above-mentioned system is used to implement a malicious encrypted traffic detection method based on a twin graph encoder, including: obtaining an encrypted traffic packet to be detected; using a pre-trained detection model to detect whether the obtained encrypted traffic packet to be detected is a detection result of a malicious encrypted traffic packet; wherein, training the detection model includes: constructing the original byte graph of the encrypted traffic packet: dividing the traffic packet into two parts, a header and a load represented by original bytes, extracting the features of the original bytes, and establishing a co-occurrence graph and a word frequency graph for the header and the load respectively; a twin graph encoder: an attention-based feature fusion module fuses the embedding vectors of the header and the load to obtain the final embedding representation of the traffic packet; attention feature fusion: using a global attention mechanism to aggregate the node feature representations of the header and the load graph to obtain the feature representation of the entire graph; wherein, the global attention aggregation mechanism assigns different attention weights to the relationship between nodes, so that the model can pay more attention to important nodes and their features, thereby obtaining more accurate graph features; the obtained two parts of the graph feature vectors are spliced ​​and input into the linear layer for transformation to obtain the final encrypted traffic packet feature representation.

[0044] In the construction of the co-occurrence graph, the original bytes of the header or payload of an encrypted traffic packet are represented as s. In order to extract the correlation features between different bytes in the packet, the co-occurrence matrix is ​​used to construct the corresponding co-occurrence graph G for s. o =(V o ,E o ,X o );V o is a node set, each byte contained in s corresponds to a node, X ois the feature set of the node; process s with a sliding window of fixed size, and construct the co-occurrence edges between the bytes that co-occur in the co-occurrence window W; for s, first use the sliding window to construct the byte co-occurrence matrix A, and use A as G o The adjacency matrix of .

[0045] In the word frequency graph construction, by constructing the word frequency graph G f =(V f ,E f ,X f ) to extract frequency features; each node in the word frequency graph represents a byte in s, and the edge is a self-loop, X f is the node feature; for the feature of node i, the frequency f of i is used i and the original byte n i Indicates its characteristics, n i Perform one-hot encoding in [0-255] to get the vector Then multiply the frequency and the original byte feature to get the final feature representation

[0046] Perform graph fusion and node embedding. After obtaining the co-occurrence graph and word frequency graph representation of the head and payload, the co-occurrence graph G o and word frequency graph G f Fusion is performed to obtain a unified graph representation G F =(V F ,E F ,X F ), and then update the embedding representation of the byte node; the nodes in the co-occurrence graph and the word frequency graph are all bytes, and the graph fusion operation is mainly divided into two parts: edge fusion and node feature fusion; the co-occurrence graph G o The adjacency matrix A o and word frequency graph G f The adjacency matrix A f The sum is the adjacency matrix A of the fusion graph F ; The node feature fusion process processes the node embedding representation in the co-occurrence graph and the word frequency graph, and obtains the new node representation X through multiplication operation F =X o ×X f ; The node embedding process updates the node representation to the fused node representation.

[0047] The twin graph encoder consists of two graph encoders with the same model structure but no shared parameters, which can process the graph structure data of the header and the load in parallel. In order to encode the graph composed of traffic packets into a feature vector, the graph encoder is composed of two stacked GraphSAGE modules. GraphSAGE is a graph neural network that can accurately extract graph structure features. For each node in the graph, GraphSAGE first uses the degree of the target node to normalize the embedding vectors of all neighboring nodes. Then GraphSAGE concatenates the embedding vectors of the target vertex and the neighboring vertices, and calculates the average of each dimension of the vector. Finally, a nonlinear transformation is performed on the generated new embedding vector of the target node to complete a forward propagation of GraphSAGE.

[0048] The information transmission and aggregation process of GraphSAGE can be formally described as follows:

[0049]

[0050] Where N(v) is the set of neighboring nodes of the target node v, |N(v)| is the number of neighboring nodes, and w (l) is the parameter in layer l, CONCAT(·) represents the concatenation operation, and σ(·) represents the activation function. The ReLU activation function is used to process the output of GraphSAGE to increase the nonlinear relationship between the layers of the network. Finally, the batch normalization layer is used to transform the updated feature vector Normalization.

[0051] After obtaining the new node feature representation through the graph encoder, feature aggregation based on the attention mechanism is performed, including: first, using the global attention mechanism to aggregate the node feature representation of the head and load graphs to obtain the feature representation of the entire graph; the global attention aggregation mechanism assigns different attention weights to the relationship between nodes, focusing on important nodes and their features, so as to obtain more accurate graph features:

[0052]

[0053] where f gate (·) is the neural network that calculates the attention score of each feature, and sets f gate (·) as a linear layer, N is the number of nodes in the graph, x k is the feature of the kth node. Then, the node features of the input header graph and payload graph are added to f attation-pooling (·) to obtain a graphical representation;

[0054] Then the two parts of the graph feature vectors are concatenated and input into the linear layer for transformation to obtain the final encrypted traffic packet feature representation:

[0055] F final =CONCAT(F header ,F payload ).

[0056] Example 2

[0057] In this embodiment 2, a malicious encrypted traffic detection system and method based on a twin graph encoder is provided. Figure 1 As shown, it includes four modules: byte graph construction, twin graph encoder, attention feature fusion, and malicious detection.

[0058] Module 1: Construction of the original byte graph of encrypted traffic packets

[0059] First, the traffic packet is divided into two parts, the header and the payload, and the original bytes are used to represent the header and the payload. Then, the features of the original bytes are extracted. Since different bytes have different meanings, the specific bytes contain different information in different contexts, and the same bytes appear at different frequencies in different data packets, a byte graph is constructed based on these three aspects of information to represent the traffic packet.

[0060] In addition, in order to distinguish the same bytes at different positions in the byte sequence, the repeated bytes are regarded as separate nodes in the graph (the number of nodes in the graph does not exceed 256) to avoid the problem of the number of graph nodes exploding. In order to effectively pass messages between nodes and fully extract the contextual information between bytes, two types of graphs are established for each part: co-occurrence graph and word frequency graph.

[0061] In the construction of the co-occurrence graph, the original bytes of the header (payload) of an encrypted traffic packet are represented as s. In order to extract the correlation features between different bytes in the packet, the co-occurrence matrix is ​​used to construct the corresponding co-occurrence graph G for s. o =(V o ,E o ,X o ). Where V o is a node set, each byte contained in s corresponds to a node, X o is the feature set of the node. We process s with a sliding window of fixed size (default is 3), and construct the co-occurrence edges between the bytes that co-occur in the co-occurrence window W. For s, we first construct the byte co-occurrence matrix A using the sliding window, and use A as G o The adjacency matrix of .

[0062] For byte nodes i and j in s, the edge between them is described by the adjacency matrix

[0063]

[0064] The features of the nodes in the graph are initialized to 1, and the co-occurrence graph is an undirected graph.

[0065] In the construction of the word frequency graph, the frequency of different bytes in the original bytes s of the header (payload) of the encrypted traffic packet is similar to the word frequency in the natural language processing task, which is an important feature. Therefore, by constructing the word frequency graph G f =(V f ,E f ,X f ) to extract frequency features. Each node in the word frequency graph represents a byte in s, and the edge is a self-loop. f is the node feature. For the feature of node i, use the frequency f of i i and the original byte n i Indicates its characteristics, n i Perform one-hot encoding in [0-255] to get the vector Then multiply the frequency and the original byte feature to get the final feature representation

[0066] Module 2: Twin Graph Encoder

[0067] In this embodiment, the traffic packet is divided into two parts: header and payload. At the same time, a twin graph encoding network is designed to process the header and payload parts of the traffic packet respectively, and then the embedded vectors of the header and payload are fused through the designed attention-based feature fusion module to obtain the final embedded representation of the traffic packet.

[0068] First, graph fusion and node embedding are performed. After obtaining the co-occurrence graph and word frequency graph representation of header (payload), in order to accurately extract the encrypted traffic features, the co-occurrence graph G o and word frequency graph G f Fusion is performed to obtain a unified graph representation G F =(V F ,E F ,X F ), and then update the embedding representation of the byte node. Figure 2 As shown in the figure, the nodes in the co-occurrence graph and the word frequency graph are all bytes. The graph fusion operation is mainly divided into two parts: edge fusion and node feature fusion. Edge fusion describes the detailed process in the form of an adjacency matrix. o The adjacency matrix A o and word frequency graph G f The adjacency matrix A f The sum is the adjacency matrix A of the fusion graph F The node feature fusion process processes the node embedding representation in the co-occurrence graph and the word frequency graph, and obtains the new node representation X through multiplication operation. F =Xo ×X f The node embedding process updates the node representation to the fused node representation.

[0069] After establishing the graph representation of the header and payload respectively, a simple but effective twin graph encoder is designed. The twin graph encoder consists of two graph encoders with the same model structure but no shared parameters, which can process the graph structure data of the header and payload in parallel. In order to encode the graph composed of traffic packets into a feature vector, the graph encoder consists of two stacked GraphSAGE modules. GraphSAGE is a graph neural network that can accurately extract graph structure features. For each node in the graph, GraphSAGE first uses the degree of the target node to normalize the embedding vectors of all neighbor nodes. GraphSAGE then concatenates the embedding vectors of the target vertex and the neighbor vertices, and averages each dimension of the vector. Finally, the generated new embedding vector of the target node is nonlinearly transformed to complete a forward propagation of GraphSAGE.

[0070] The information transmission and aggregation process of GraphSAGE can be formally described as follows:

[0071]

[0072] Where N(v) is the set of neighbor nodes of the target node v, |N(v)| is the number of neighboring nodes, and w (l) is the parameter in layer l, CONCAT(·) represents the concatenation operation, and σ(·) represents the activation function.

[0073] Then, the ReLU activation function is used to process the output of GraphSAGE to increase the nonlinear relationship between the layers of the network. Finally, the batch normalization layer is used to transform the updated feature vector Normalization.

[0074] The number of GraphSAGE layers represents the number of hops of neighbor nodes that each vertex can aggregate. Each additional layer can aggregate information of a more distant layer of neighbors. Too many layers will lead to oversmoothing problems. Moreover, experiments have verified that the number of stacked layers of GraphSAGE modules does not need to be too large, and good results can be achieved when the number of layers is 2. Therefore, two layers of GraphSAGE modules are stacked, and the output of the first GraphSAGE module is used as the input of the second block.

[0075] Module 3: Attention Feature Fusion

[0076] After constructing the graph representation of the encrypted traffic packet, the encrypted traffic packet classification task is transformed into a graph classification problem. Therefore, after obtaining the new node feature representation through the graph encoder, a feature aggregation method based on the attention mechanism is designed. First, the node feature representation of the header and payload graphs is aggregated using the global attention mechanism to obtain the feature representation of the entire graph. The global attention aggregation mechanism assigns different attention weights to the relationship between nodes, allowing the model to pay more attention to important nodes and their features, thereby obtaining more accurate graph features.

[0077]

[0078] where f gate (·) is the neural network that calculates the attention score of each feature, and sets f gate (·) as a linear layer, N is the number of nodes in the graph, x k is the feature of the kth node. Then, the node features of the input header graph and payload graph are added to f attation-pooling (·) to obtain a graphical representation.

[0079] The two parts of the graph feature vectors are then concatenated and input into the linear layer for transformation to obtain the final encrypted traffic packet feature representation.

[0080] F final =CONCAT(F header ,F payload ) (5)

[0081] Module 4: Malicious Detection

[0082] After obtaining the final feature vector of the encrypted traffic packet, recurrent neural networks, linear neural networks, convolutional neural networks, etc. can be used to perform downstream tasks of malicious traffic packet detection. In this paper, a fully connected neural network is used to process the features, and then the softmax operation is used to obtain the detection results of malicious encrypted traffic packets.

[0083] The model loss is then calculated using the cross entropy loss function, which is used for backpropagation during training.

[0084]

[0085] Where W and b are the parameters of the fully connected layer, is the predicted value, Q is the number of samples, and C is the number of traffic categories.

[0086] Example 3

[0087] This embodiment 3 provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by a processor, the malicious encrypted traffic detection method based on the twin graph encoder as described above is implemented. The method includes:

[0088] Obtain the encrypted traffic packet to be detected;

[0089] A pre-trained detection model is used to detect whether the encrypted traffic packet to be detected is a malicious encrypted traffic packet detection result; wherein, the training of the detection model includes: constructing the original byte graph of the encrypted traffic packet: dividing the traffic packet into two parts, a header and a load, represented by the original bytes, extracting the features of the original bytes, and establishing a co-occurrence graph and a word frequency graph for the header and the load respectively; a twin graph encoder: an attention-based feature fusion module fuses the embedding vectors of the header and the load to obtain the final embedding representation of the traffic packet; attention feature fusion: using the global attention mechanism to aggregate the node feature representations of the header and the load graph to obtain the feature representation of the entire graph; wherein, the global attention aggregation mechanism assigns different attention weights to the relationship between nodes, so that the model can pay more attention to important nodes and their features, thereby obtaining more accurate graph features; the obtained two parts of the graph feature vectors are spliced ​​and input into the linear layer for transformation to obtain the final encrypted traffic packet feature representation.

[0090] Example 4

[0091] This embodiment 4 provides a computer device, including a memory and a processor, the processor and the memory communicate with each other, the memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the malicious encrypted traffic detection method based on the twin graph encoder as described above, the method comprising:

[0092] Obtain the encrypted traffic packet to be detected;

[0093] A pre-trained detection model is used to detect whether the encrypted traffic packet to be detected is a malicious encrypted traffic packet detection result; wherein, the training of the detection model includes: constructing the original byte graph of the encrypted traffic packet: dividing the traffic packet into two parts, a header and a load, represented by the original bytes, extracting the features of the original bytes, and establishing a co-occurrence graph and a word frequency graph for the header and the load respectively; a twin graph encoder: an attention-based feature fusion module fuses the embedding vectors of the header and the load to obtain the final embedding representation of the traffic packet; attention feature fusion: using the global attention mechanism to aggregate the node feature representations of the header and the load graph to obtain the feature representation of the entire graph; wherein, the global attention aggregation mechanism assigns different attention weights to the relationship between nodes, so that the model can pay more attention to important nodes and their features, thereby obtaining more accurate graph features; the obtained two parts of the graph feature vectors are spliced ​​and input into the linear layer for transformation to obtain the final encrypted traffic packet feature representation.

[0094] Example 5

[0095] This embodiment 5 provides an electronic device, including: a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory, so that the electronic device executes instructions for implementing the malicious encrypted traffic detection method based on the twin graph encoder as described above, and the method includes:

[0096] Obtain the encrypted traffic packet to be detected;

[0097] A pre-trained detection model is used to detect whether the encrypted traffic packet to be detected is a malicious encrypted traffic packet detection result; wherein, the training of the detection model includes: constructing the original byte graph of the encrypted traffic packet: dividing the traffic packet into two parts, a header and a load, represented by the original bytes, extracting the features of the original bytes, and establishing a co-occurrence graph and a word frequency graph for the header and the load respectively; a twin graph encoder: an attention-based feature fusion module fuses the embedding vectors of the header and the load to obtain the final embedding representation of the traffic packet; attention feature fusion: using the global attention mechanism to aggregate the node feature representations of the header and the load graph to obtain the feature representation of the entire graph; wherein, the global attention aggregation mechanism assigns different attention weights to the relationship between nodes, so that the model can pay more attention to important nodes and their features, thereby obtaining more accurate graph features; the obtained two parts of the graph feature vectors are spliced ​​and input into the linear layer for transformation to obtain the final encrypted traffic packet feature representation.

[0098] In summary, the malicious encrypted traffic detection method based on the twin graph encoder described in the embodiment of the present invention designs a modeling method based on the fusion of co-occurrence graph and word frequency graph. This method can make full use of the original information of the encrypted traffic by processing the original byte representation of the header and payload respectively. The twin graph encoder structure is designed to directly process the original traffic packet from the byte level to avoid introducing noise, extract byte-level features using graph convolution, adopt a global attention aggregation algorithm, distinguish the feature contribution of each node in the encrypted traffic graph, and obtain an accurate representation of the encrypted traffic. The encrypted traffic byte-level modeling method based on the fusion of co-occurrence graph and word frequency graph of the present invention respectively establishes a co-occurrence graph and a word frequency graph according to the byte information of the header and payload of the encrypted traffic, and obtains the final encrypted traffic graph representation through node embedding and graph fusion mechanism, which can more fully mine the hidden features of malicious and normal encrypted traffic. At the same time, the twin graph encoder based on graph convolution of the present invention uses graph convolution and global attention mechanism to obtain the embedded representation of the header and payload graphs respectively, and obtains the vector representation of the encrypted traffic efficiently and accurately through the designed feature fusion module, and finally inputs the malicious encrypted traffic detection module, which can detect malicious encrypted traffic more efficiently and accurately.

[0099] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0100] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0101] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0102] These computer program instructions can also be loaded onto a computer or other programmable data processing device, and a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0103] Although the above describes the specific implementation mode of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative work on the basis of the technical solution disclosed in the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for detecting malicious encrypted traffic based on a twin graph encoder, characterized in that: include: Obtain the encrypted traffic packet to be detected; A pre-trained detection model is used to detect whether the encrypted traffic packet to be detected is a malicious encrypted traffic packet detection result; wherein, the training of the detection model includes: constructing the original byte graph of the encrypted traffic packet: dividing the traffic packet into two parts, a header and a load, represented by the original bytes, extracting the features of the original bytes, and establishing a co-occurrence graph and a word frequency graph for the header and the load respectively; a twin graph encoder: an attention-based feature fusion module fuses the embedding vectors of the header and the load to obtain the final embedding representation of the traffic packet; attention feature fusion: using the global attention mechanism to aggregate the node feature representations of the header and the load graph to obtain the feature representation of the entire graph; wherein, the global attention aggregation mechanism assigns different attention weights to the relationship between nodes, so that the model can pay more attention to important nodes and their features, thereby obtaining more accurate graph features; the obtained two parts of the graph feature vectors are spliced ​​and input into the linear layer for transformation to obtain the final encrypted traffic packet feature representation.

2. The malicious encrypted traffic detection method based on twin graph encoder according to claim 1 is characterized in that: In the construction of the co-occurrence graph, the original bytes of the header or payload of an encrypted traffic packet are represented as s. In order to extract the correlation features between different bytes in the packet, the co-occurrence matrix is ​​used to construct the corresponding co-occurrence graph G for s. o =(V o ,E o ,X o );V o is a node set, each byte contained in s corresponds to a node, X o is the feature set of the node; process s with a sliding window of fixed size, and construct the co-occurrence edges between the bytes that co-occur in the co-occurrence window W; for s, first use the sliding window to construct the byte co-occurrence matrix A, and use A as G o The adjacency matrix of .

3. The malicious encrypted traffic detection method based on twin graph encoder according to claim 2 is characterized in that: In the word frequency graph construction, by constructing the word frequency graph G f =(V f ,E f ,X f ) to extract frequency features; each node in the word frequency graph represents a byte in s, and the edge is a self-loop, X f is the node feature; for the feature of node i, the frequency f of i is used i and the original byte n i Indicates its characteristics, n i Perform one-hot encoding in [0-255] to get the vector Then multiply the frequency and the original byte feature to get the final feature representation 4. The malicious encrypted traffic detection method based on twin graph encoder according to claim 3 is characterized in that: Perform graph fusion and node embedding. After obtaining the co-occurrence graph and word frequency graph representation of the head and payload, the co-occurrence graph G o and word frequency graph G f Fusion is performed to obtain a unified graph representation G F =(V F ,E F ,X F ), and then update the embedding representation of the byte node; the nodes in the co-occurrence graph and the word frequency graph are all bytes, and the graph fusion operation is mainly divided into two parts: edge fusion and node feature fusion; the co-occurrence graph G o The adjacency matrix A o and word frequency graph G f The adjacency matrix A f The sum is the adjacency matrix A of the fusion graph F ; The node feature fusion process processes the node embedding representation in the co-occurrence graph and the word frequency graph, and obtains the new node representation X through multiplication operation F =X o ×X f ; The node embedding process updates the node representation to the fused node representation.

5. The malicious encrypted traffic detection method based on twin graph encoder according to claim 1 is characterized in that: The twin graph encoder consists of two graph encoders with the same model structure but no shared parameters, which can process the graph structure data of the header and the load in parallel. In order to encode the graph composed of traffic packets into a feature vector, the graph encoder is composed of two stacked GraphSAGE modules. GraphSAGE is a graph neural network that can accurately extract graph structure features. For each node in the graph, GraphSAGE first uses the degree of the target node to normalize the embedding vectors of all neighboring nodes. Then GraphSAGE concatenates the embedding vectors of the target vertex and the neighboring vertices, and calculates the average of each dimension of the vector. Finally, a nonlinear transformation is performed on the generated new embedding vector of the target node to complete a forward propagation of GraphSAGE.

6. The method for detecting malicious encrypted traffic based on twin graph encoder according to claim 5 is characterized in that: The information transmission and aggregation process of GraphSAGE is described in the following formalization: Where N(v) is the set of neighboring nodes of the target node v, |N(v)| is the number of neighboring nodes, and w (l) is the parameter in layer l, CONCAT(·) represents the concatenation operation, and σ(·) represents the activation function. The ReLU activation function is used to process the output of GraphSAGE to increase the nonlinear relationship between the layers of the network. Finally, the batch normalization layer is used to transform the updated feature vector Normalization.

7. The method for detecting malicious encrypted traffic based on twin graph encoder according to claim 5 is characterized in that: After obtaining the new node feature representation through the graph encoder, feature aggregation based on the attention mechanism is performed, including: first, using the global attention mechanism to aggregate the node feature representation of the head and load graphs to obtain the feature representation of the entire graph; the global attention aggregation mechanism assigns different attention weights to the relationship between nodes, focusing on important nodes and their features, so as to obtain more accurate graph features: where f gate (·) is the neural network that calculates the attention score of each feature, and sets f gate (·) as a linear layer, N is the number of nodes in the graph, x k is the feature of the kth node. Then, the node features of the input header graph and payload graph are added to f attation-pooling (·) to obtain a graphical representation; Then the two parts of the graph feature vectors are concatenated and input into the linear layer for transformation to obtain the final encrypted traffic packet feature representation: F final =CONCAT(F header ,F payload )。 8. A malicious encrypted traffic detection system based on twin graph encoder, characterized in that: include: An acquisition module, used to acquire the encrypted traffic packet to be detected; A detection module is used to use a pre-trained detection model to detect whether the encrypted traffic packet to be detected is a malicious encrypted traffic packet; wherein, training the detection model includes: constructing the original byte graph of the encrypted traffic packet: dividing the traffic packet into two parts, a header and a load, represented by the original bytes, extracting the features of the original bytes, and establishing a co-occurrence graph and a word frequency graph for the header and the load respectively; a twin graph encoder: an attention-based feature fusion module fuses the embedding vectors of the header and the load to obtain the final embedding representation of the traffic packet; attention feature fusion: using a global attention mechanism to aggregate the node feature representations of the header and the load graph to obtain the feature representation of the entire graph; wherein the global attention aggregation mechanism assigns different attention weights to the relationship between nodes, so that the model can pay more attention to important nodes and their features, thereby obtaining more accurate graph features; the obtained two-part graph feature vectors are spliced ​​and input into the linear layer for transformation to obtain the final encrypted traffic packet feature representation.

9. A computer device, characterized in that: It includes a memory and a processor, the processor and the memory communicate with each other, the memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the malicious encrypted traffic detection method based on the twin graph encoder as described in any one of claims 1-7.

10. An electronic device, characterized in that: include: A processor, a memory and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory so that the electronic device executes instructions for implementing the malicious encrypted traffic detection method based on the twin graph encoder as described in any one of claims 1-7.

Images