Malicious encrypted traffic detection method and system based on twin graph encoder

Abstract

This invention provides a method and system for detecting malicious encrypted traffic based on a twin graph encoder, belonging to the field of network privacy protection technology. The method involves acquiring encrypted traffic packets to be detected and using a pre-trained detection model to determine whether the acquired encrypted traffic packets are malicious. This invention utilizes a modeling method based on the fusion of co-occurrence graphs and word frequency graphs. It models the header and payload of the traffic packets separately at the byte level, and uses a global attention mechanism to fuse the features of the traffic byte graph nodes to obtain the final graph embedding representation. This allows for the full exploitation of hidden features between malicious and normal encrypted traffic, enabling efficient and accurate detection of malicious encrypted traffic.

Description

Technical Field

[0001] This invention relates to the field of network privacy protection technology, specifically to a method and system for detecting malicious encrypted traffic based on a twin graph encoder. Background Technology

[0002] To protect user privacy, network traffic is typically transmitted encrypted, with encryption technologies such as TLS and network anonymity technologies like VPN and Tor being widely adopted. Traditional traffic analysis methods include port-based techniques and deep packet inspection (DPI) methods, which use specific rules to filter and identify traffic. Port-based traffic analysis methods determine the type of traffic by its port, but the complex and ever-changing network environment, along with the increasing use of dynamic port allocation and non-standard interfaces in network services, makes these methods inaccurate and ineffective in identifying traffic types. Deep packet inspection (DPI) technology relies on prior knowledge to extract keywords and patterns from the payload of traffic packets to classify the traffic. However, the payload of encrypted traffic is ciphertext, significantly reducing the usability of DPI technology.

[0003] To address these issues, learning-based methods have been introduced into encrypted traffic identification. Early machine learning algorithms, such as random forests and support vector machines, relied on manually constructed statistical features, resulting in insufficient stability. Subsequently, deep learning methods, such as convolutional neural networks and recurrent neural networks, learned encrypted traffic features through packet size sequences, but failed to fully utilize the raw information. Therefore, methods based on pre-trained models were introduced, utilizing raw byte information as input, and categorized into language model-based and image model-based methods. However, these methods are complex and fail to effectively distinguish between header and payload features, introducing noise and impacting efficiency. Graph learning methods have also been introduced due to their ability to extract relational features, but existing methods have a simplistic modeling approach, failing to fully extract raw byte features, and their models are complex and do not address the detection of malicious encrypted traffic.

[0004] In summary, in existing technologies, network traffic is typically transmitted after encryption, and network anonymity technologies are widely used. While encrypted traffic protects user privacy, it can be maliciously exploited by attackers to conceal their attack activities. After encryption, key information such as the payload cannot be directly parsed, making traffic feature extraction more difficult. Detecting malicious encrypted traffic from complex network traffic is challenging. Summary of the Invention

[0005] The purpose of this invention is to provide a method and system for detecting malicious encrypted traffic based on a twin graph encoder, so as to solve at least one of the technical problems existing in the background art.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] In a first aspect, the present invention provides a method for detecting malicious encrypted traffic based on a twin graph encoder, comprising:

[0008] Obtain the encrypted traffic packets to be detected;

[0009] The detection results of whether the acquired encrypted traffic packets to be detected are malicious are obtained using a pre-trained detection model. The training of the detection model includes: constructing the original byte graph of the encrypted traffic packet: dividing the traffic packet into a header and a payload represented using original bytes, extracting features from the original bytes, and building co-occurrence graphs and term frequency graphs for the header and payload respectively; a Siamese graph encoder: fusing the embedding vectors of the header and payload using an attention-based feature fusion module to obtain the final traffic packet embedding representation; attention feature fusion: aggregating the node feature representations of the header and payload graphs using a global attention mechanism to obtain the feature representation of the entire graph; wherein, the global attention aggregation mechanism assigns different attention weights to the relationships between nodes, enabling the model to pay more attention to important nodes and their features, thereby obtaining more accurate graph features; concatenating the graph feature vectors of the two parts and inputting them into a linear layer for transformation to obtain the final encrypted traffic packet feature representation.

[0010] Furthermore, in the co-occurrence graph construction, the raw bytes of the header or payload of an encrypted traffic packet are represented as s. In order to extract the correlation features between different bytes in the packet, a co-occurrence graph G is constructed using the co-occurrence matrix s. o =(V o E o ,X o ); where V o It is a set of nodes, where each byte in s corresponds to a node, and X o Let be the feature set of the nodes; process s using a sliding window of fixed size, and construct co-occurrence edges between bytes that co-occur in the co-occurrence window W; for s, first construct the co-occurrence matrix A of bytes using the sliding window, and use A as G. o The adjacency matrix.

[0011] Furthermore, in the construction of the word frequency graph, by constructing the word frequency graph G... f =(V f E f ,X f To extract frequency features; each node in the word frequency graph represents a byte in s, and the edges are self-loops, X f For node features, the frequency f of node i is used. i and the original byte n i To represent its characteristics, n i One-hot encoding is performed in the range [0-255] to obtain the vector. Then, the frequency and the original byte features are multiplied together to obtain the final feature representation.

[0012] Furthermore, graph fusion and node embedding are performed. After obtaining the co-occurrence graph and word frequency graph representations of the header and payload, the co-occurrence graph G is... o and word frequency graph G f The fusion process yields a unified graph representation G. F =(V F E F ,X F Then, the embedding representation of the byte nodes is updated; where the nodes in the co-occurrence graph and the word frequency graph are all bytes, the graph fusion operation is mainly divided into two parts: edge fusion and node feature fusion; the co-occurrence graph G is then... o Adjacency matrix A o and word frequency graph G f Adjacency matrix A f The sum is the adjacency matrix A of the fused graph. F The node feature fusion process processes the node embedding representations in the co-occurrence graph and word frequency graph, and obtains a new node representation X through multiplication. F =X o ×X f The node embedding process updates the node representation to the merged node representation.

[0013] Furthermore, the Siamese graph encoder consists of two graph encoders with identical model structures but no shared parameters, enabling parallel processing of graph structure data from the header and payload. To encode the graph composed of traffic packets into feature vectors, the graph encoder is composed of two stacked GraphSAGE modules, which are graph neural networks capable of accurately extracting graph structure features. For each node in the graph, GraphSAGE first normalizes the embedding vectors of all neighboring nodes using the degree of the target node. Then, GraphSAGE concatenates the embedding vectors of the target vertex and its neighboring vertices and performs an averaging operation on each dimension of the vector. Finally, a nonlinear transformation is performed on the newly generated embedding vector of the target node, completing one forward propagation of GraphSAGE.

[0014] Furthermore, the information transfer and aggregation process of GraphSAGE can be formally described as follows:

[0015]

[0016] Where N(v) is the set of neighboring nodes of the target node v, |N(v)| is the number of neighboring nodes, and w (l)These are the parameters in layer l. CONCAT(·) represents the concatenation operation, and σ(·) represents the activation function. The ReLU activation function is used to process the output of GraphSAGE, increasing the non-linear relationship between the network layers. Finally, a batch normalization layer is used to update the feature vector. Normalization.

[0017] Furthermore, after obtaining new node feature representations through the graph encoder, feature aggregation based on an attention mechanism is performed, including: firstly, using a global attention mechanism to aggregate the node feature representations of the head and payload graphs to obtain the feature representation of the entire graph; the global attention aggregation mechanism assigns different attention weights to the relationships between nodes, focusing on important nodes and their features, thereby obtaining more accurate graph features.

[0018]

[0019] Where f gate (·) is a neural network that calculates the attention score for each feature, with f set to... gate (·) represents a linear layer, where N is the number of nodes in the graph, and x k This is the feature of the k-th node. Then, the node features of the input header graph and payload graph are added to f. attation-pooling (·) to obtain a graphical representation;

[0020] The two graph feature vectors are then concatenated and input into a linear layer for transformation to obtain the final encrypted traffic packet feature representation.

[0021] F final =CONCAT(F header ,F payload ).

[0022] Secondly, the present invention provides a malicious encrypted traffic detection system based on a twin graph encoder, comprising:

[0023] The acquisition module is used to acquire the encrypted traffic packets to be detected;

[0024] The detection module is used to detect whether the acquired encrypted traffic packets are malicious using a pre-trained detection model. The training of the detection model includes: constructing the original byte graph of the encrypted traffic packet: dividing the traffic packet into a header and a payload represented by original bytes, extracting features from the original bytes, and building co-occurrence graphs and term frequency graphs for the header and payload respectively; a Siamese graph encoder: fusing the embedding vectors of the header and payload based on an attention-based feature fusion module to obtain the final traffic packet embedding representation; attention feature fusion: aggregating the node feature representations of the header and payload graphs using a global attention mechanism to obtain the feature representation of the entire graph; wherein, the global attention aggregation mechanism assigns different attention weights to the relationships between nodes, enabling the model to pay more attention to important nodes and their features, thereby obtaining more accurate graph features; concatenating the graph feature vectors of the two parts and inputting them into a linear layer for transformation to obtain the final encrypted traffic packet feature representation.

[0025] Thirdly, the present invention provides a non-transitory computer-readable storage medium for storing computer instructions, which, when executed by a processor, implement the malicious encrypted traffic detection method based on a twin graph encoder as described in the first aspect.

[0026] Fourthly, the present invention provides a computer device including a memory and a processor, wherein the processor and the memory communicate with each other, the memory stores program instructions executable by the processor, and the processor invokes the program instructions to execute the malicious encrypted traffic detection method based on twin graph encoder as described in the first aspect.

[0027] Fifthly, the present invention provides an electronic device, comprising: a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to cause the electronic device to execute instructions for implementing the malicious encrypted traffic detection method based on twin graph encoder as described in the first aspect.

[0028] The beneficial effects of this invention are as follows: Based on the modeling method of co-occurrence graph and word frequency graph fusion, the header and payload of the traffic packet are modeled separately at the byte level. The features of the traffic byte graph nodes are fused using a global attention mechanism to obtain the final graph embedding representation. This can fully explore the hidden features of malicious and normal encrypted traffic and efficiently and accurately detect malicious encrypted traffic.

[0029] The advantages of additional aspects of the invention will be set forth more clearly in the following description or will be learned by practice of the invention. Attached Figure Description

[0030] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 This is a flowchart of the malicious encrypted traffic detection method based on a twin graph encoder as described in an embodiment of the present invention.

[0032] Figure 2 This is a schematic diagram of the collinearity graph and word frequency graph fusion process described in an embodiment of the present invention. Detailed Implementation

[0033] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0034] It will be understood by those skilled in the art that, unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0035] It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with their meanings in the context of the prior art, and should not be interpreted in an idealized or overly formal sense unless defined as here.

[0036] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. It should be further understood that the term “comprising” as used in this specification means the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, and / or groups thereof.

[0037] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of those different embodiments or examples.

[0038] To facilitate understanding of the present invention, the present invention will be further explained and described below with reference to the accompanying drawings and specific embodiments. However, the specific embodiments do not constitute a limitation on the embodiments of the present invention.

[0039] Those skilled in the art should understand that the accompanying drawings are merely schematic diagrams of embodiments, and the components in the drawings are not necessarily essential for implementing the present invention.

[0040] This invention provides a malicious encrypted traffic detection method based on a Siamese graph encoder. It establishes a co-occurrence graph and a term frequency graph based on the byte information of the encrypted traffic's header and payload, respectively. Through node embedding and graph fusion mechanisms, the final graph representation of the encrypted traffic is obtained, and then end-to-end malicious encrypted traffic detection is performed. This method is based on a graph convolutional Siamese graph encoder, utilizing graph convolution and global attention mechanisms to obtain the embedded representations of the header and payload graphs, respectively. A designed feature fusion module efficiently and accurately obtains the vector representation of the encrypted traffic, which is then input into the malicious encrypted traffic detection module. Currently, to protect user privacy, traffic is usually propagated in encrypted form over the network. While encrypted traffic protects user privacy, it can be maliciously exploited by attackers to conceal attack behaviors. After encryption, key information such as the payload cannot be directly parsed, making traffic feature extraction more difficult. Detecting malicious encrypted traffic from complex network traffic is challenging. Designing accurate malicious traffic modeling methods and mining potential hidden features to obtain accurate encrypted traffic representations remain two major technical challenges. This method primarily addresses the challenges of modeling malicious traffic and mining hidden features of encrypted traffic. It can fully uncover the hidden features of both malicious and normal encrypted traffic and efficiently and accurately detect malicious encrypted traffic.

[0041] Example 1

[0042] In this embodiment 1, a malicious encrypted traffic detection system based on a Siamese graph encoder is first provided, including: an acquisition module for acquiring encrypted traffic packets to be detected; and a detection module for using a pre-trained detection model to detect whether the acquired encrypted traffic packets to be detected are malicious encrypted traffic packets. The training of the detection model includes: constructing an original byte graph of the encrypted traffic packet: dividing the traffic packet into a header and a payload represented by original bytes, extracting features from the original bytes, and establishing a co-occurrence graph and a term frequency graph for the header and payload respectively; a Siamese graph encoder: fusing the embedding vectors of the header and payload using an attention-based feature fusion module to obtain the final traffic packet embedding representation; attention feature fusion: aggregating the node feature representations of the header and payload graphs using a global attention mechanism to obtain the feature representation of the entire graph; wherein, the global attention aggregation mechanism assigns different attention weights to the relationships between nodes, enabling the model to pay more attention to important nodes and their features, thereby obtaining more accurate graph features; concatenating the graph feature vectors of the two parts and inputting them into a linear layer for transformation to obtain the final encrypted traffic packet feature representation.

[0043] In this embodiment, the above-described system is used to implement a malicious encrypted traffic detection method based on a Siamese graph encoder, including: acquiring encrypted traffic packets to be detected; using a pre-trained detection model to detect whether the acquired encrypted traffic packets to be detected are malicious encrypted traffic packets; wherein, training the detection model includes: constructing the original byte graph of the encrypted traffic packets: dividing the traffic packets into two parts, a header and a payload, represented by original bytes, extracting features of the original bytes, and establishing co-occurrence graphs and word frequency graphs for the header and payload respectively; Siamese graph encoder: fusing the embedding vectors of the header and payload based on an attention-based feature fusion module to obtain the final embedding representation of the traffic packets; attention feature fusion: aggregating the node feature representations of the header and payload graphs using a global attention mechanism to obtain the feature representation of the entire graph; wherein, the global attention aggregation mechanism assigns different attention weights to the relationships between nodes, enabling the model to pay more attention to important nodes and their features, thereby obtaining more accurate graph features; concatenating the graph feature vectors of the two parts and inputting them into a linear layer for transformation to obtain the final feature representation of the encrypted traffic packets.

[0044] In co-occurrence graph construction, the raw bytes of the header or payload of an encrypted traffic packet are represented as s. To extract the correlation features between different bytes in the packet, a co-occurrence graph G is constructed using the co-occurrence matrix s. o =(V o E o ,X o ); where V o It is a set of nodes, where each byte in s corresponds to a node, and X oLet be the feature set of the nodes; process s using a sliding window of fixed size, and construct co-occurrence edges between bytes that co-occur in the co-occurrence window W; for s, first construct the byte co-occurrence matrix A using the sliding window, and use A as G. o The adjacency matrix.

[0045] In word frequency graph construction, word frequency graph G is constructed. f =(V f E f ,X f To extract frequency features; each node in the word frequency graph represents a byte in s, and the edges are self-loops, X f For node features, the frequency f of node i is used. i and the original byte n i To represent its characteristics, n i One-hot encoding is performed in the range [0-255] to obtain the vector. Then, the frequency and the original byte features are multiplied together to obtain the final feature representation.

[0046] After performing graph fusion and node embedding to obtain the co-occurrence graph and word frequency graph representations of the header and payload, the co-occurrence graph G is... o and word frequency graph G f The fusion process yields a unified graph representation G. F =(V F E F ,X F Then, the embedding representation of the byte nodes is updated; where the nodes in the co-occurrence graph and the word frequency graph are all bytes, the graph fusion operation is mainly divided into two parts: edge fusion and node feature fusion; the co-occurrence graph G is then... o Adjacency matrix A o and word frequency graph G f Adjacency matrix A f The sum is the adjacency matrix A of the fused graph. F The node feature fusion process processes the node embedding representations in the co-occurrence graph and word frequency graph, and obtains a new node representation X through multiplication. F =X o ×X f The node embedding process updates the node representation to the merged node representation.

[0047] The Siamese graph encoder consists of two graph encoders with identical model structures but no shared parameters, enabling parallel processing of graph structure data from the header and payload. To encode the graph composed of traffic packets into feature vectors, the graph encoder is composed of two stacked GraphSAGE modules. GraphSAGE is a graph neural network that can accurately extract graph structure features. For each node in the graph, GraphSAGE first normalizes the embedding vectors of all neighboring nodes using the degree of the target node. Then, GraphSAGE concatenates the embedding vectors of the target vertex and its neighboring vertices and averages each dimension of the vector. Finally, a nonlinear transformation is performed on the newly generated embedding vector of the target node, completing one forward propagation of GraphSAGE.

[0048] The information transfer and aggregation process of GraphSAGE can be formally described as follows:

[0049]

[0050] Where N(v) is the set of neighboring nodes of the target node v, |N(v)| is the number of neighboring nodes, and w (l) These are the parameters in layer l. CONCAT(·) represents the concatenation operation, and σ(·) represents the activation function. The ReLU activation function is used to process the output of GraphSAGE, increasing the non-linear relationship between the network layers. Finally, a batch normalization layer is used to update the feature vector. Normalization.

[0051] After obtaining new node feature representations through the graph encoder, feature aggregation based on an attention mechanism is performed. This includes: firstly, using a global attention mechanism to aggregate the node feature representations of the head and payload graphs to obtain the feature representation of the entire graph; the global attention aggregation mechanism assigns different attention weights to the relationships between nodes, focusing on important nodes and their features, thereby obtaining more accurate graph features.

[0052]

[0053] Where f gate (·) is a neural network that calculates the attention score for each feature, and f is set to... gate (·) represents a linear layer, where N is the number of nodes in the graph, and x k This is the feature of the k-th node. Then, the node features of the input header graph and payload graph are added to f. attation-pooling (·) to obtain a graphical representation;

[0054] The two graph feature vectors are then concatenated and input into a linear layer for transformation to obtain the final encrypted traffic packet feature representation.

[0055] F final =CONCAT(F header ,F payload ).

[0056] Example 2

[0057] In this embodiment 2, a malicious encrypted traffic detection system and method based on a twin graph encoder are provided, such as... Figure 1 As shown, it includes four modules: byte graph construction, twin graph encoder, attention feature fusion, and malicious detection.

[0058] Module 1: Construction of Raw Byte Graph of Encrypted Traffic Packets

[0059] First, the traffic packet is divided into two parts: header and payload, which are represented using raw bytes. Then, features are extracted from the raw bytes. Since different bytes have different meanings, the information contained in a specific byte varies depending on its position in the context, and the same byte appears with different frequencies in different parts of the data packet, a byte graph is constructed based on these three aspects of information to represent the traffic packet.

[0060] Furthermore, to distinguish identical bytes at different positions in the byte sequence, repeated bytes are treated as individual nodes in the graph (the number of nodes in the graph does not exceed 256), avoiding the problem of graph node explosion. To effectively pass messages between nodes and fully extract contextual information between bytes, two types of graphs are built for each part: a co-occurrence graph and a word frequency graph.

[0061] In co-occurrence graph construction, the raw bytes of the header (payload) of an encrypted traffic packet are represented as s. To extract the correlation features between different bytes in the packet, a co-occurrence graph G is constructed using the co-occurrence matrix s. o =(V o E o ,X o ). Among them, V o It is a set of nodes, where each byte in s corresponds to a node, and X o Let be the feature set of the nodes. A sliding window of fixed size (default 3) is used to process s. For bytes that co-occur in the co-occurrence window W, co-occurrence edges are constructed between them. For s, first, a co-occurrence matrix A of bytes is constructed using the sliding window, and A is used as G. o The adjacency matrix.

[0062] For byte nodes i and j in s, the edges between them are described by an adjacency matrix.

[0063]

[0064] The features of the nodes in the graph are initialized to 1, and the co-occurrence graph is an undirected graph.

[0065] In constructing a word frequency graph, the frequency of different bytes in the original bytes s of the encrypted traffic packet header (payload) is similar to the word frequency in natural language processing tasks, which is an important feature. Therefore, constructing a word frequency graph G is crucial. f =(V f E f ,X f To extract frequency features, each node in the term frequency graph represents a byte in s, and the edges are self-loops. f For node features, the frequency f of node i is used. i and the original byte n i To represent its characteristics, n i One-hot encoding is performed in the range [0-255] to obtain the vector. Then, the frequency and the original byte features are multiplied together to obtain the final feature representation.

[0066] Module 2: Twin Graph Encoder

[0067] In this embodiment, the traffic packet is divided into two parts: header and payload. Simultaneously, a Siamese graph coding network is designed to process the header and payload parts of the traffic packet separately. Then, an attention-based feature fusion module is designed to fuse the embedding vectors of the header and payload to obtain the final traffic packet embedding representation.

[0068] First, graph fusion and node embedding are performed. After obtaining the co-occurrence graph and term frequency graph representations of the header (payload), in order to accurately extract the features of encrypted traffic, the co-occurrence graph G is... o and word frequency graph G f The fusion process yields a unified graph representation G. F =(V F E F ,X F Then update the embedded representation of the byte node. For example... Figure 2 As shown, the nodes in the co-occurrence graph and word frequency graph are all bytes. The graph fusion operation is mainly divided into two parts: edge fusion and node feature fusion. Edge fusion describes the detailed process in the form of an adjacency matrix, which is used to fuse the co-occurrence graph G. o Adjacency matrix A o and word frequency graph G f Adjacency matrix A f The sum is the adjacency matrix A of the fused graph. F The node feature fusion process handles the node embedding representations in the co-occurrence graph and word frequency graph, and obtains a new node representation X through a multiplication operation. F =Xo ×X f The node embedding process updates the node representation to the merged node representation.

[0069] After establishing graph representations for the header and payload separately, a simple yet effective Siamese graph encoder was designed. The Siamese graph encoder consists of two graph encoders with identical model structures but shared parameters, enabling parallel processing of the graph structure data of the header and payload. To encode the graph composed of traffic packets into feature vectors, the graph encoder is composed of two stacked GraphSAGE modules, a graph neural network capable of accurately extracting graph structure features. For each node in the graph, GraphSAGE first normalizes the embedding vectors of all neighboring nodes using the degree of the target node. Then, GraphSAGE concatenates the embedding vectors of the target vertex and its neighboring vertices, and averages each dimension of the vector. Finally, a nonlinear transformation is applied to the newly generated embedding vector of the target node, completing one forward propagation of GraphSAGE.

[0070] The information transfer and aggregation process of GraphSAGE can be formally described as follows:

[0071]

[0072] Where N(v) is the set of neighboring nodes of the target node v, |N(v)| is the number of neighboring nodes, and w (l) These are parameters in layer l, where CONCAT(·) represents the concatenation operation and σ(·) represents the activation function.

[0073] Then, the ReLU activation function is used to process the output of GraphSAGE, increasing the non-linear relationship between the network layers. Finally, a batch normalization layer is used to update the feature vector. Normalization.

[0074] The number of layers in GraphSAGE represents the number of hops each vertex can aggregate to its neighboring nodes. Each additional layer allows for the aggregation of information from more distant neighbors. However, too many layers can lead to over-smoothing. Furthermore, experiments have shown that the stacking depth of GraphSAGE modules does not need to be excessively large; a stacking depth of 2 is sufficient to achieve good results. Therefore, two layers of GraphSAGE modules were stacked, with the output of the first module used as the input to the second.

[0075] Module 3: Attention Feature Fusion

[0076] After constructing the graph representation of encrypted traffic packets, the encrypted traffic packet classification task transforms into a graph classification problem. Therefore, after obtaining new node feature representations through a graph encoder, a feature aggregation method based on an attention mechanism is designed. First, a global attention mechanism is used to aggregate the node feature representations of the header and payload graphs to obtain the feature representation of the entire graph. The global attention aggregation mechanism assigns different attention weights to the relationships between nodes, enabling the model to focus more on important nodes and their features, thereby obtaining more accurate graph features.

[0077]

[0078] Where f gate (·) is a neural network that calculates the attention score for each feature, and f is set to... gate (·) represents a linear layer, where N is the number of nodes in the graph, and x k This is the feature of the k-th node. Then, the node features of the input header graph and payload graph are added to f. attation-pooling (·) is used to obtain a graphical representation.

[0079] The two graph feature vectors are then concatenated and input into a linear layer for transformation to obtain the final encrypted traffic packet feature representation.

[0080] F final =CONCAT(F header ,F payload (5)

[0081] Module 4: Malicious Detection

[0082] After obtaining the feature vector of the final encrypted traffic packet, downstream tasks such as recurrent neural networks, linear neural networks, and convolutional neural networks can be used to detect malicious traffic packets. In this paper, a fully connected neural network is used to process the features, and then the softmax operation is used to obtain the detection results of malicious encrypted traffic packets.

[0083] Subsequently, the model loss is calculated using the cross-entropy loss function and used for backpropagation during training.

[0084]

[0085] Where W and b are the parameters of the fully connected layer. Q is the predicted value, C is the number of samples, and C is the number of traffic categories.

[0086] Example 3

[0087] This embodiment 3 provides a non-transitory computer-readable storage medium for storing computer instructions. When executed by a processor, the computer instructions implement the malicious encrypted traffic detection method based on a twin graph encoder as described above. The method includes:

[0088] Obtain the encrypted traffic packets to be detected;

[0089] The detection results of whether the acquired encrypted traffic packets to be detected are malicious are obtained using a pre-trained detection model. The training of the detection model includes: constructing the original byte graph of the encrypted traffic packet: dividing the traffic packet into a header and a payload represented using original bytes, extracting features from the original bytes, and building co-occurrence graphs and term frequency graphs for the header and payload respectively; a Siamese graph encoder: fusing the embedding vectors of the header and payload using an attention-based feature fusion module to obtain the final traffic packet embedding representation; attention feature fusion: aggregating the node feature representations of the header and payload graphs using a global attention mechanism to obtain the feature representation of the entire graph; wherein, the global attention aggregation mechanism assigns different attention weights to the relationships between nodes, enabling the model to pay more attention to important nodes and their features, thereby obtaining more accurate graph features; concatenating the graph feature vectors of the two parts and inputting them into a linear layer for transformation to obtain the final encrypted traffic packet feature representation.

[0090] Example 4

[0091] This embodiment 4 provides a computer device, including a memory and a processor, wherein the processor and the memory communicate with each other, and the memory stores program instructions that can be executed by the processor. The processor calls the program instructions to execute the malicious encrypted traffic detection method based on a twin graph encoder as described above, the method including:

[0092] Obtain the encrypted traffic packets to be detected;

[0093] The detection results of whether the acquired encrypted traffic packets to be detected are malicious are obtained using a pre-trained detection model. The training of the detection model includes: constructing the original byte graph of the encrypted traffic packet: dividing the traffic packet into a header and a payload represented using original bytes, extracting features from the original bytes, and building co-occurrence graphs and term frequency graphs for the header and payload respectively; a Siamese graph encoder: fusing the embedding vectors of the header and payload using an attention-based feature fusion module to obtain the final traffic packet embedding representation; attention feature fusion: aggregating the node feature representations of the header and payload graphs using a global attention mechanism to obtain the feature representation of the entire graph; wherein, the global attention aggregation mechanism assigns different attention weights to the relationships between nodes, enabling the model to pay more attention to important nodes and their features, thereby obtaining more accurate graph features; concatenating the graph feature vectors of the two parts and inputting them into a linear layer for transformation to obtain the final encrypted traffic packet feature representation.

[0094] Example 5

[0095] This embodiment 5 provides an electronic device, including: a processor, a memory, and a computer program; wherein, the processor is connected to the memory, and the computer program is stored in the memory. When the electronic device is running, the processor executes the computer program stored in the memory to cause the electronic device to execute instructions implementing the malicious encrypted traffic detection method based on a twin graph encoder as described above. The method includes:

[0096] Obtain the encrypted traffic packets to be detected;

[0097] The detection results of whether the acquired encrypted traffic packets to be detected are malicious are obtained using a pre-trained detection model. The training of the detection model includes: constructing the original byte graph of the encrypted traffic packet: dividing the traffic packet into a header and a payload represented using original bytes, extracting features from the original bytes, and building co-occurrence graphs and term frequency graphs for the header and payload respectively; a Siamese graph encoder: fusing the embedding vectors of the header and payload using an attention-based feature fusion module to obtain the final traffic packet embedding representation; attention feature fusion: aggregating the node feature representations of the header and payload graphs using a global attention mechanism to obtain the feature representation of the entire graph; wherein, the global attention aggregation mechanism assigns different attention weights to the relationships between nodes, enabling the model to pay more attention to important nodes and their features, thereby obtaining more accurate graph features; concatenating the graph feature vectors of the two parts and inputting them into a linear layer for transformation to obtain the final encrypted traffic packet feature representation.

[0098] In summary, the malicious encrypted traffic detection method based on a twin graph encoder described in this invention employs a modeling approach based on the fusion of co-occurrence graphs and word frequency graphs. This method fully utilizes the original information of the encrypted traffic by processing the raw byte representations of the header and payload separately. A twin graph encoder structure is designed to directly process raw traffic packets at the byte level, avoiding the introduction of noise. Byte-level features are extracted using graph convolution, and a global attention aggregation algorithm is adopted to distinguish the feature contribution of each node in the encrypted traffic graph, obtaining an accurate representation of the encrypted traffic. This invention's byte-level modeling method for encrypted traffic based on the fusion of co-occurrence graphs and word frequency graphs establishes co-occurrence graphs and word frequency graphs based on the byte information of the encrypted traffic's header and payload, respectively. Through node embedding and graph fusion mechanisms, the final encrypted traffic graph representation is obtained, enabling a more thorough mining of the hidden features of malicious and normal encrypted traffic. Simultaneously, this invention's twin graph encoder based on graph convolution utilizes graph convolution and global attention mechanisms to obtain the embedded representations of the header and payload graphs, and through a designed feature fusion module, efficiently and accurately obtains the vector representation of the encrypted traffic. Finally, this vector representation is input into the malicious encrypted traffic detection module, enabling more efficient and accurate detection of malicious encrypted traffic.

[0099] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0100] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0101] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0102] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment, whereby a series of operational steps are performed to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0103] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that, based on the technical solutions disclosed in the present invention, various modifications or variations that can be made by those skilled in the art without creative effort should be included within the scope of protection of the present invention.

Claims

1. A method for detecting malicious encrypted traffic based on a twin graph encoder, characterized in that, include: Obtain the encrypted traffic packets to be detected; The detection model uses a pre-trained detection model to detect whether the acquired encrypted traffic packets are malicious. The detection model includes: an encrypted traffic packet raw byte graph construction module, used to divide the traffic packet into a header and a payload represented using raw bytes, establishing co-occurrence graphs and term frequency graphs for both the header and payload, extracting contextual information between bytes based on the co-occurrence graph and term frequency graph, and constructing a byte graph to represent the traffic packet; and a Siamese graph encoder, used to fuse the header's co-occurrence graph and term frequency graph after obtaining the header and payload co-occurrence graph and term frequency graph representations to obtain a unified header node feature representation, and to fuse the payload's co-occurrence graph and term frequency graph. The system combines the features of the header node and the load node into a unified representation. The attention feature fusion module uses a global attention aggregation mechanism to concatenate the header node and load node representations and input them into a linear layer for transformation, resulting in the final encrypted traffic packet feature representation. The global attention aggregation mechanism assigns different attention weights to the relationships between nodes, enabling the model to focus more on important nodes and their features, thus obtaining more accurate graph features. The detection module, after obtaining the final encrypted traffic packet feature representation, uses a fully connected neural network to process the features and employs a softmax operation to obtain the detection results of malicious encrypted traffic packets.

2. The malicious encrypted traffic detection method based on a twin graph encoder according to claim 1, characterized in that, In co-occurrence graph construction, the raw bytes of the header or payload of an encrypted traffic packet are represented as s. To extract the correlation features between different bytes in the packet, a co-occurrence matrix s is used to construct the corresponding co-occurrence graph G. o =(V o E o ,X o ); where V o It is a set of nodes, where each byte in s corresponds to a node, and X o Let be the feature set of the nodes; process s using a sliding window of fixed size, and construct co-occurrence edges between bytes that co-occur in the co-occurrence window W; for s, construct a co-occurrence matrix A of bytes using the sliding window, and use A as G. o The adjacency matrix.

3. The malicious encrypted traffic detection method based on a twin graph encoder according to claim 2, characterized in that, In word frequency graph construction, word frequency graph G is constructed. f =(V f E f ,X f To extract frequency features; each node in the word frequency graph represents a byte in s, and the edges are self-loops, X f For node features, the frequency f of node i is used. i and the original byte n i To represent its characteristics, n i One-hot encoding is performed in the range [0-255] to obtain the vector. Then, the frequency and the original byte features are multiplied together to obtain the final feature representation.

4. The malicious encrypted traffic detection method based on a twin graph encoder according to claim 3, characterized in that, After performing graph fusion and node embedding to obtain the co-occurrence graph and word frequency graph representations of the header and payload, the co-occurrence graph G is... o and word frequency graph G f The fusion process yields a unified graph representation G. F =(V F E F ,X F Then, the embedding representation of the byte nodes is updated; where the nodes in the co-occurrence graph and the word frequency graph are all bytes, the graph fusion operation is mainly divided into two parts: edge fusion and node feature fusion; the co-occurrence graph G is then... o Adjacency matrix A o and word frequency graph G f Adjacency matrix A f The sum is the adjacency matrix A of the fused graph. F The node feature fusion process processes the node embedding representations in the co-occurrence graph and word frequency graph, and obtains a new node representation X through multiplication. F =X o ×X f The node embedding process updates the node representation to the merged node representation.

5. The malicious encrypted traffic detection method based on a twin graph encoder according to claim 1, characterized in that, The Siamese graph encoder consists of two graph encoders with identical model structures but no shared parameters, enabling parallel processing of graph structure data from the header and payload. To encode the graph composed of traffic packets into feature vectors, the graph encoder is composed of two stacked GraphSAGE modules. GraphSAGE is a graph neural network that can accurately extract graph structure features. For each node in the graph, GraphSAGE first normalizes the embedding vectors of all neighboring nodes using the degree of the target node. Then, GraphSAGE concatenates the embedding vectors of the target node and its neighbors and averages each dimension of the vector. Finally, a nonlinear transformation is performed on the newly generated embedding vector of the target node, completing one forward propagation of GraphSAGE.

6. The malicious encrypted traffic detection method based on a twin graph encoder according to claim 5, characterized in that, The information transfer and aggregation process of GraphSAGE is formally described as follows: Where N(v) is the set of neighboring nodes of the target node v, |N(v)| is the number of neighboring nodes, and w (l) These are the parameters in layer l. CONCAT(·) represents the concatenation operation, and σ(·) represents the activation function. The ReLU activation function is used to process the output of GraphSAGE, increasing the non-linear relationship between the network layers. Finally, a normalization layer is used to update the feature vector. Normalization.

7. The malicious encrypted traffic detection method based on a twin graph encoder according to claim 5, characterized in that, After obtaining new node feature representations through the graph encoder, feature aggregation based on an attention mechanism is performed. This includes: firstly, a global attention aggregation mechanism is used to aggregate the feature representations of the head nodes and the load nodes to obtain the feature representation of the entire graph; the global attention aggregation mechanism assigns different attention weights to the relationships between nodes, focusing on important nodes and their features, thereby obtaining more accurate graph features. Where f gate (·) is a neural network that calculates the attention score for each feature, and f is set to... gate (·) represents a linear layer, where N is the number of nodes in the graph, and x k The features of the k-th node are then added to f, along with the node features of the input header and load. attation-pooling (·) to obtain a graphical representation; The obtained header node feature representation and payload node feature representation are then concatenated and input into a linear layer for transformation to obtain the final encrypted traffic packet feature representation: F final =CONCAT(F header ,F payload )。 8. A malicious encrypted traffic detection system based on a twin graph encoder, characterized in that, include: The acquisition module is used to acquire the encrypted traffic packets to be detected; The processing module uses a pre-trained detection model to detect whether the acquired encrypted traffic packets to be detected are malicious encrypted traffic packets. The detection model includes: an encrypted traffic packet raw byte graph construction module, used to divide the traffic packet into a header and a payload represented using raw bytes, establishing co-occurrence graphs and term frequency graphs for both the header and payload, extracting contextual information between bytes based on the co-occurrence graph and term frequency graph, and constructing a byte graph to represent the traffic packet; and a Siamese graph encoder, used to fuse the co-occurrence graph and term frequency graph of the header to obtain a unified header node feature representation after obtaining the co-occurrence graph and term frequency graph representations of the header and payload, and fuse the co-occurrence graph and term frequency graph of the payload. The system integrates the features of the header and load nodes to obtain a unified representation. An attention feature fusion module uses a global attention aggregation mechanism to concatenate the header and load node feature representations before inputting them into a linear layer for transformation, resulting in the final encrypted traffic packet feature representation. The global attention aggregation mechanism assigns different attention weights to the relationships between nodes, allowing the model to focus more on important nodes and their features, thus obtaining more accurate graph features. A detection module, after obtaining the final encrypted traffic packet feature representation, uses a fully connected neural network to process the features and employs a softmax operation to obtain the detection results for malicious encrypted traffic packets.

9. A computer device, characterized in that, The method includes a memory and a processor, the processor and the memory communicating with each other, the memory storing program instructions executable by the processor, and the processor calling the program instructions to execute the malicious encrypted traffic detection method based on a twin graph encoder as described in any one of claims 1-7.

10. An electronic device, characterized in that, include: The device includes a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to cause the electronic device to execute instructions that implement the malicious encrypted traffic detection method based on a twin graph encoder as described in any one of claims 1-7.

Images