Network abnormal flow detection method based on dynamic heterogeneous attribute graph representation learning

Abstract

The invention discloses a network abnormal flow detection method based on dynamic heterogeneous attribute graph representation learning. The method is used for detecting network abnormal flow of a variable target network environment. From the perspective of dynamic evolution, firstly, data acquisition is carried out on a variable environment of a target network, and a topological structure and attribute information of a target network entity are obtained in a mode of combining active exploration and network space search engine detection; self-adaptive modeling is carried out on a variable network environment through a dynamic heterogeneous attribute network; on the basis, node characterization is learned through a multi-head residual image attention network and a recurrent neural network together so as to capture dynamic change attributes and traffic behavior modes of nodes; and finally, abnormal traffic detection is carried out by predicting dynamic traffic of the two nodes.

Description

Technical Field

[0001] The present invention belongs to the technical field of anomaly detection, and more specifically, relates to a network abnormal traffic detection method based on dynamic heterogeneous attribute graph representation learning. Background Art

[0002] Anomaly detection is an important task in the field of cyberspace security, which aims to identify data points or sequences that do not conform to normal behavior patterns. The purpose of network abnormal traffic detection is to analyze network traffic data at different time points and identify abnormal behaviors in the network, such as network attacks, internal threats, and malware activities. Common forms of network attacks include DDoS attacks, port scanning, and malicious traffic injection, while internal threats include data leakage and unauthorized access, and malware activities are manifested as botnet communications or ransomware traffic. Since these abnormal behaviors are related to traffic to a certain extent, real-time abnormal traffic detection is of great significance in the field of network security.

[0003] Traditional abnormal traffic detection often builds anomaly detection models based on threshold methods or deep learning, but these methods often ignore the inherent coupling between traffic. Therefore, anomaly detection based on graph representation learning has received increasing attention in recent years. However, these methods often focus on static graphs and lack analysis of dynamic changes in network environment characteristics, resulting in poor detection of network abnormal traffic and failure to effectively capture evolutionary patterns in traffic data. In addition, in real scenarios, traffic anomaly label data is difficult to obtain effectively. Therefore, how to perform reliability detection of network abnormal traffic under unlabeled data conditions from the perspective of dynamic graphs is a key issue that needs to be urgently addressed in this field. Summary of the invention

[0004] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a network abnormal traffic detection method based on dynamic heterogeneous attribute graph representation learning to achieve abnormal traffic detection in a variable network environment.

[0005] To achieve the above-mentioned object of the invention, the present invention provides a method for detecting abnormal network traffic based on dynamic heterogeneous attribute graph representation learning, which is characterized by comprising the following steps:

[0006] (1) Network dynamic environment data collection: The network dynamic environment data collection is carried out by combining active exploration with cyberspace search engine detection, mainly including dynamic real-time collection of information such as entities in the target network (such as routers, security devices, middleware, servers, personal computers, etc.) and related attributes (such as device models, operating system types, open ports, port services), etc.

[0007] (2) Adaptive network environment modeling based on dynamic heterogeneous attribute network: In view of the dynamic characteristics of network environment, dynamic heterogeneous attribute network is used to model the network environment. Different nodes in the network correspond to different network entities in the target network. Node attributes correspond to the status of network entities. The connection between networks corresponds to the topological connection or communication relationship between different devices. The weight of the edge represents the traffic between nodes.

[0008] (3) Dynamic heterogeneous attribute graph representation learning based on residual and multi-head attention mechanism: Node representation is learned through the attribute attention network of the multi-head attention mechanism, and dynamic information aggregation is performed through the gated recurrent unit, so that the learned representation can learn the dynamically changing target network behavior pattern;

[0009] (4) Abnormal traffic detection based on dynamic graph representation: The dynamic traffic in the network is predicted by calculating the representation of two nodes with an edge in the dynamic graph. If the difference between the actual value and the predicted value is higher than a certain threshold, it can be determined that the traffic between the two nodes is abnormal.

[0010] The object of the present invention is achieved in this way.

[0011] The present invention discloses a network abnormal traffic detection method based on dynamic heterogeneous attribute graph representation learning, which is used to detect abnormal traffic on the target network. Starting from the perspective of dynamic evolution, the invention first collects data on the variable environment of the target network, and obtains the topological structure and attribute information of the target network entity by combining active exploration with cyberspace search engine detection; then adaptively models the variable network environment through a dynamic heterogeneous attribute network; on this basis, the node representation is jointly learned through a multi-head residual graph attention network and a recurrent neural network to capture the dynamically changing attributes and traffic behavior patterns of the nodes; finally, the reasoning process can quickly predict the dynamic traffic in the network by calculating the representations of two nodes, thereby detecting abnormal traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is a flowchart of a specific implementation method of the network abnormal traffic detection method based on dynamic heterogeneous attribute graph representation learning of the present invention;

[0013] Figure 2 It is a schematic diagram of network dynamic environment data collection based on active exploration combined with cyberspace search engine detection in the present invention;

[0014] Figure 3 It is a schematic diagram of adaptive environment modeling based on dynamic heterogeneous attribute network in the present invention;

[0015] Figure 4This is a schematic diagram of dynamic heterogeneous attribute graph representation learning based on residual and multi-head attention mechanism in the present invention. DETAILED DESCRIPTION

[0016] The specific implementation modes of the present invention are described below in conjunction with the accompanying drawings so that those skilled in the art can better understand the present invention. It should be noted that in the following description, when detailed descriptions of known functions and designs may dilute the main contents of the present invention, these descriptions will be ignored here.

[0017] Figure 1 It is a flow chart of a specific implementation of the network abnormal traffic detection method based on dynamic heterogeneous attribute graph representation learning of the present invention.

[0018] In this embodiment, if Figure 1 As shown, the network abnormal traffic detection method based on dynamic heterogeneous attribute graph representation learning of the present invention includes the following steps:

[0019] S1: Network dynamic environment data collection

[0020] Network environment data collection requires the collection of network entities in the target network (such as network devices, security devices, middleware, servers, personal computers and other devices) and the attributes of these entities (such as model, operating system type, open ports, port services and other information). The network topology and network entity attributes of the dynamic network environment can be fully collected by combining active exploration with cyberspace search engine detection.

[0021] Active detection obtains specific information about the target by actively constructing data packets and requesting connections to the target machine. Cyberspace search engines, on the other hand, are based on deep or breadth-first data detection based on open network address spaces and network namespaces, which can quickly detect target network assets, making up for the shortcomings of active detection, which is slow and easily intercepted by security devices. In the present invention, active detection uses a port-based scanning model to regularly scan the target network, and uses information from the transport layer and application layer in the network, such as port status and response content, to extract the services running on the target host, and on this basis, further obtain the target service and its fingerprint. The above information can also be used for subsequent vulnerability scanning.

[0022] Figure 2 This paper presents a method for collecting dynamic environment data of target network by combining active exploration with cyberspace search engine detection. Firstly, the approximate range of target network is quickly and accurately located through cyberspace search engine, which reduces the search space of active detection and improves the information accuracy of passive detection. Then, the target network port is scanned regularly, and the services and fingerprints of target host are extracted by using the port status and response content.

[0023] S2: Adaptive Environment Modeling Based on Dynamic Heterogeneous Attribute Networks

[0024] In view of the dynamic characteristics of the network environment, a dynamic heterogeneous attribute network is used to model the network variable environment. The actively detected network path will be applied to the construction of the graph, and the port-service combination information will be used as the attribute of the node. Since the detection results are mostly in the format of strings, it is difficult for general graph network models to process them. The characteristic text of the service running on the target host is further compressed into a code of a specific length through the MD5 message digest algorithm, and then converted into a vector form.

[0025] In specific implementation, Figure 3 As shown, after the detector obtains the initial state of the network through the network resource detector at time T0, it obtains the attributes of each node in the network and the topological structure of the network, that is, The subscript 0 represents the 0th time, G0 represents the network at the 0th time, represents the related attributes of each node device at time 0, n represents the number of nodes, and A0 represents the adjacency matrix of the network topology at time 0. When the detector detects that the network node has changed, it sends incremental update information of network changes, such as adding or deleting connections between nodes, or updating network node information. After the model receives the update information, the network diagram information is automatically updated to G t =(X t ,A t ). In the figure, nodes of different shapes represent different network entities, and red edges and nodes represent information about the dynamic changes of the network.

[0026] S3: Dynamic Heterogeneous Attribute Graph Representation Learning Based on Residual and Multi-Head Attention Mechanism

[0027] Dynamic heterogeneous attribute graph representation aims to learn various attributes and behaviors of different nodes in the graph, so that the learned vectors retain the structural information, attribute information, etc. of the nodes in the graph as much as possible, so as to effectively capture the normal communication traffic coupling relationship between different network entities. Since the topological structure of the target network entity and its related attributes will evolve dynamically over time, in this case, compared with the traditional static graph representation network, the dynamic heterogeneous attribute graph representation technology can more accurately learn the traffic pattern in the target network. Based on this, the present invention adopts a multi-head residual graph attention network and a recurrent neural network to jointly learn node representations to capture the dynamically changing attributes and traffic behavior patterns of network nodes.

[0028] In this embodiment, if Figure 4 As shown, the specific method is:

[0029] 3.1) Attribute Heterogeneous Residual Graph Attention Network

[0030] Since the attributes of nodes change and update at every moment, in order to include the dynamic changes of attributes and the changes of network topology over time in the representation, the initial node representation in the network at time t is the aggregation of the node representation at time t-1 and the node attributes at time t:

[0031]

[0032] The aggregation operations include averaging, merging, etc.

[0033] Since the graph attention network is a graph neural network with strong performance in homogeneous graphs, the present invention applies the graph attention network to dynamic heterogeneous attribute graphs. In order to make full use of the information contained in the heterogeneous nodes and edges in the heterogeneous graph, the edge type information r ψ(<i,j>) Add it to the attention mechanism and combine it with subsequent operations to fuse the node types.

[0034]

[0035] in is the attention weight corresponding to the edge between node i and node j, h t,i and h t,j Represents the representation of node i and node j respectively, ψ(<i.j> ) represents the edge type between node i and node j, r ψ(<i,j>) represents the representation of this edge type at the current moment, which contains the node interaction time and the relevant information of the two end nodes, W and W r These are parameters that need to be learned.

[0036] In order to alleviate the problems of over-smoothing and gradient vanishing in graph neural networks, residual connections of nodes and edges are introduced into the model. Residual connections also ensure the reusability of features, and can use features learned from early layers in deeper layers, thereby reducing the redundancy of the model and speeding up model training.

[0037] Specifically, a residual connection is added before the activation function for the node representation:

[0038]

[0039] in is the attention weight corresponding to the edge between node i and node j, σ is the activation function, W (l) are the parameters that need to be learned.

[0040] In particular, if the dimension of the representation changes between the (l-1)th layer and the lth layer, an additional linear transformation is required:

[0041]

[0042] in It will help transform the representation of the (l-1)th layer.

[0043] The residual connection of the edge is reflected in the attention weight, specifically:

[0044]

[0045] The hyperparameter β∈[0,1] is a scaling factor that plays a balancing role.

[0046] In addition, a multi-head attention mechanism is used to enhance the expressiveness of the model. K independent attention mechanisms are used for learning, and the results learned by each mechanism are merged in the final representation. Therefore, the update rule of the final node representation is as follows:

[0047]

[0048] Where || represents the merging operation of representations, is the kth linear change The calculated attention weights.

[0049] Get the node representation of the last layer After that, L2 regularization is performed on it to make the distribution of representation in the latent space smoother and more reasonable:

[0050]

[0051] 3.2) Network dynamic information aggregation based on gated recurrent units

[0052] After obtaining the representation learned by the residual heterogeneous graph attention network, it is input into the recurrent neural network, so that the model can better capture the dynamic evolution pattern of the nodes.

[0053] Due to the common problems of gradient diffusion and gradient explosion in ordinary recurrent neural networks, the present invention considers using a gated recurrent unit to model the timing information in the node representation.

[0054]

[0055] The representation of node i at time t-1 is e t-1,i is the hidden state, and the graph network learns is the input of GRU.

[0056] 3.3) Traffic prediction based on representation similarity

[0057] In order to better learn the representation and perform subsequent traffic anomaly detection, when predicting the traffic of the edge between two nodes, the similarity between the representations of the two nodes is used to reflect it, as shown in formula (11):

[0058] Prob r (u,v is positive) = sigmoid(e t,u ×e t,v ) (11)

[0059] Where × can represent a dot product, cosine, or DistMult operation.

[0060] Finally, the similarity is passed through a multi-layer perceptron for traffic prediction, using the Log-cosh loss function, that is, the prediction loss at time t is expressed as the difference between the predicted traffic and the actual traffic:

[0061]

[0062] Where D t are all the edges that actually have traffic, y t,u～v represents the real traffic between node u and node v at time t, It indicates that the model predicts the flow between node u and node v.

[0063] The entire dynamic graph neural network can be trained through the Log-cosh loss function to obtain the dynamic representation of each node in the network at different times.

[0064] S4: Traffic anomaly detection based on dynamic attribute network node representation

[0065] Since the attributes and behaviors of entities in the network are dynamically changing, under such conditions, it is impossible to use a fixed traffic threshold to make anomaly judgments. The present invention detects abnormal network traffic through learned dynamic representations. For network entities and traffic information in a variable environment, the new topological structure and attributes of the nodes at the current moment are first incrementally acquired, and then the difference between the traffic between nodes u and v predicted by the representation model and the actual traffic is used for anomaly detection.

[0066] In this embodiment, the traffic anomaly detection method is specifically as follows:

[0067] 4.1) First, obtain the new topological structure and attributes at the current moment (only the changed edges and attributes need to be dynamically updated);

[0068] 4.2) Use the trained graph representation model to infer the predicted traffic on the edges with traffic Assume that the real flow is y t,u～v, the average error of the flow between node u and node v during the model training phase is μ u～v , with standard deviation σ u～v , use formula (11) to calculate the f(u,v) value:

[0069]

[0070] Among them, f(u,v)=1 means that the traffic between two nodes is abnormal, and f(u,v)=0 means it is normal.

[0071] Although the above describes the illustrative specific embodiments of the present invention to facilitate those skilled in the art to understand the present invention, it should be clear that the present invention is not limited to the scope of the specific embodiments. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations using the concept of the present invention are protected.

Claims

1. A network abnormal traffic detection method based on dynamic heterogeneous attribute graph representation learning, characterized in that: The following steps are involved: (1) Network dynamic environment data collection: The network dynamic environment data collection is carried out by combining active exploration with cyberspace search engine detection, mainly including dynamic real-time collection of information such as entities in the target network (such as routers, security devices, middleware, servers, personal computers, etc.) and related attributes (such as device models, operating system types, open ports, port services), etc. (2) Adaptive network environment modeling based on dynamic heterogeneous attribute network: In view of the dynamic characteristics of network environment, dynamic heterogeneous attribute network is used to model the network environment. Different nodes in the network correspond to different network entities in the target network. Node attributes correspond to the status of network entities. The connection between networks corresponds to the topological connection or communication relationship between different devices. The weight of the edge represents the traffic between nodes. (3) Dynamic heterogeneous attribute graph representation learning based on residual and multi-head attention mechanism: Node representation is learned through the attribute attention network of the multi-head attention mechanism, and dynamic information aggregation is performed through the gated recurrent unit, so that the learned representation can learn the dynamically changing target network behavior pattern; (4) Abnormal traffic detection based on dynamic graph representation: The dynamic traffic in the network is predicted by calculating the representation of two nodes with an edge in the dynamic graph. If the difference between the actual value and the predicted value is higher than a certain threshold, it can be determined that the traffic between the two nodes is abnormal.

2. The method for detecting anomalies in dynamic graphs according to claim 1, characterized in that: In step (3), the dynamic heterogeneous attribute graph representation learning based on residual and multi-head attention mechanism is as follows: 3.1) Attribute Heterogeneous Residual Graph Attention Network Since the attributes of nodes change and update at every moment, in order to include the dynamic changes of attributes and the changes of network topology over time in the representation, the initial node representation in the network at time t is the aggregation of the node representation at time t-1 and the node attributes at time t: The aggregation operations include averaging, merging, etc. Since the graph attention network is a graph neural network with strong performance in homogeneous graphs, the present invention applies the graph attention network to dynamic heterogeneous attribute graphs. In order to make full use of the information contained in the heterogeneous nodes and edges in the heterogeneous graph, the edge type information r ψ(<i,j>) Add it to the attention mechanism and combine it with subsequent operations to fuse the node types. in is the attention weight corresponding to the edge between node i and node j, h t,i and h t,j Represents the representation of node i and node j respectively, ψ(<i.j> ) represents the edge type between node i and node j, r ψ(<i,j>) represents the representation of this edge type at the current moment, which contains the node interaction time and the relevant information of the two end nodes, W and W r These are parameters that need to be learned. In order to alleviate the problems of over-smoothing and gradient vanishing in graph neural networks, residual connections of nodes and edges are introduced into the model. Residual connections also ensure the reusability of features, and can use features learned from early layers in deeper layers, thereby reducing the redundancy of the model and speeding up model training. Specifically, a residual connection is added before the activation function for the node representation: in is the attention weight corresponding to the edge between node i and node j, σ is the activation function, W (l) are the parameters that need to be learned. In particular, if the dimension of the representation changes between the (l-1)th layer and the lth layer, an additional linear transformation is required: in It will help transform the representation of the (l-1)th layer. The residual connection of the edge is reflected in the attention weight, specifically: The hyperparameter β∈[0,1] is a scaling factor that plays a balancing role. In addition, a multi-head attention mechanism is used to enhance the expressiveness of the model. K independent attention mechanisms are used for learning, and the results learned by each mechanism are merged in the final representation. Therefore, the update rule of the final node representation is as follows: Where || represents the merging operation of representations, is the kth linear change The calculated attention weights. Get the node representation of the last layer After that, L2 regularization is performed on it to make the distribution of representation in the latent space smoother and more reasonable: 3.2) Network dynamic information aggregation based on gated recurrent units After obtaining the representation learned by the residual heterogeneous graph attention network, it is input into the recurrent neural network, so that the model can better capture the dynamic evolution pattern of the nodes. Due to the common problems of gradient diffusion and gradient explosion in ordinary recurrent neural networks, the present invention considers using a gated recurrent unit to model the timing information in the node representation. The representation of node i at time t-1 is e t-1,i is the hidden state, and the graph network learns is the input of GRU. 3.3) Traffic prediction based on representation similarity In order to better learn the representation and perform subsequent traffic anomaly detection, when predicting the traffic of the edge between two nodes, the similarity between the representations of the two nodes is used to reflect it, as shown in formula (11): Prob r (u,v is positive)=sigmoid(e t,u ×e t,v ) (11) Where × can represent a dot product, cosine, or DistMult operation. Finally, the similarity is passed through a multi-layer perceptron for traffic prediction, using the Log-cosh loss function, that is, the prediction loss at time t is expressed as the difference between the predicted traffic and the actual traffic: Where D t are all the edges that actually have traffic, y t,u～v represents the real traffic between node u and node v at time t, It indicates that the model predicts the flow between node u and node v. The entire dynamic graph neural network can be trained through the Log-cosh loss function to obtain the dynamic representation of each node in the network at different times.

Images