Network abnormal attack behavior detection method based on SDN and graph neural network

Abstract

The application relates to the field of network security and artificial intelligence, in particular to a network abnormal attack behavior detection method based on an SDN and a graph neural network, wherein the method comprises the following steps: collecting traffic data saved by an SDN switch according to an SDN controller; calculating node traffic characteristic values; constructing a network traffic undirected graph structure; calculating edge traffic characteristic values; combining the node traffic characteristic values and the edge traffic characteristic values with the undirected graph structure, and then inputting the combination into a GNN model for modeling, training, and obtaining a trained network abnormal attack behavior detection model; and detecting newly collected traffic data through the trained network abnormal attack behavior detection model to obtain a detection result. The application combines the SDN and the GNN, utilizes the dynamic network management capability of the SDN, improves the accuracy and real-time performance of network abnormal attack behavior detection, models the complex network topology and the correlation between nodes through the GNN, and thus effectively detects various types of network abnormal attack behaviors.

Description

Technical Field

[0001] The present invention relates to the fields of network security and artificial intelligence, and more specifically, to a method for detecting abnormal network attack behaviors based on SDN and graph neural networks. Background Art

[0002] Abnormal network attack behavior refers to malicious activities or operations that deviate from normal communication patterns within a network, typically intended to disrupt normal network functionality, steal data, or cause service interruptions. This type of attack behavior manifests itself through unusual traffic patterns, unusual access requests, or other anomalous operations. Common examples include denial of service (DoS / DDoS) attacks, intrusions, malicious scanning, data tampering, and theft. In recent years, numerous methods for detecting abnormal network attack behavior have been proposed, primarily categorized as statistical learning-based and machine learning-based. Statistical learning-based methods are relatively simple to implement, consume relatively low computational resources, and are effective in detecting certain simple attack behaviors. However, these methods are less adaptable to multiple attack pattern variations within a single attack behavior, making them particularly difficult to effectively address when faced with dynamic and diverse attacks, potentially resulting in high false positives and false negatives.

[0003] The prior art discloses a method for detecting LDoS attacks in SDN based on DBO-SVM, which includes using a sliding window based on the OpenFlow protocol to collect TCP and UDP traffic sequences of normal networks and networks under LDoS attack, and labeling them. The traffic features of TCP and UDP in the window are calculated, and the mutual information values ​​of the features and labels are calculated. The mutual information values ​​are sorted, and the features with the largest mutual information values ​​are selected as the optimal feature combination. By updating the position of the dung beetle and calculating the fitness value, the DBO-SVM model parameters are updated until the maximum number of iterations is reached, and the parameters finally obtained by the iteration are used to train the LDoS attack detection model DBO-SVM. However, this method is often difficult to detect multiple attack behaviors at the same time. In addition, when faced with complex network topology and the relationship between nodes, traditional machine learning models cannot effectively capture the mutual correlations and hidden dependencies between attacks, resulting in reduced detection accuracy.

[0004] In summary, this paper proposes a network abnormal attack behavior detection method based on SDN and graph neural network. It can dynamically perceive network traffic characteristics and model complex network topology and the relationship between nodes through graph neural network, so as to effectively detect various types of network abnormal attack behaviors. Summary of the Invention

[0005] The purpose of this invention is to disclose a method for detecting abnormal network attack behaviors based on SDN and graph neural network with better hiding effect.

[0006] To achieve the above objectives, the present invention provides a method for detecting abnormal network attack behaviors based on SDN and graph neural network, comprising:

[0007] S1: Collect traffic data stored by the SDN switch according to the SDN controller;

[0008] S2: Based on the traffic data, calculate the node traffic characteristic value on each SDN switch that has the characteristics of abnormal attack traffic;

[0009] S3: Based on the actual network topology, an undirected graph structure of network traffic is constructed: the nodes in the undirected graph structure represent the actual SDN switches, and the edges represent the actual forwarding paths of the traffic. The edge traffic feature value of each edge is calculated to represent the characteristics of abnormal attack traffic.

[0010] S4: combining the node traffic characteristic value and the edge traffic characteristic value with the undirected graph structure to obtain a combined undirected graph structure; inputting the combined undirected graph structure into the GNN model for modeling to obtain a network abnormal attack behavior detection model; training the network abnormal attack behavior detection model to obtain a trained network abnormal attack behavior detection model;

[0011] S5: Detect the newly collected traffic data through the trained network abnormal attack behavior detection model to obtain the detection results.

[0012] Furthermore, in step S1, it includes: the SDN controller regularly collects traffic data of all SDN switches in the network through the OpenFlow protocol, and summarizes and integrates the traffic data, wherein the traffic data includes at least one of the following: traffic metadata, traffic path and traffic size; wherein the traffic path includes at least one of the following: source IP address and destination IP address.

[0013] Furthermore, in step S2, the node traffic characteristic value includes at least one of the following: the average number of bytes of data flow of the SDN switch, the average duration of data flow, the entropy of the source IP address, the port change rate, and the network protocol change rate.

[0014] Furthermore, in step S2, it includes:

[0015] The average number of bytes of the data stream is calculated as follows:

[0016] The formula for the average number of bytes of data stream within the acquisition period T is:

[0017]

[0018] Where FlowNum represents the total number of flows in the collection period T, and BytesNum represents the number of bytes in the data packet of each flow;

[0019] The average duration of the data stream is calculated as follows:

[0020] The formula for the average duration of data flow within the acquisition period T is:

[0021]

[0022] Where FlowNum represents the total number of flows within the collection period T, and DurationTime represents the lifetime of each flow;

[0023] The entropy of the source IP address is calculated as follows:

[0024] The entropy formula of the source IP address within the collection period T is:

[0025]

[0026] Among them, FlowNum j Indicates the total number of flows with IP address j as the destination within the collection period T, IP ij Indicates the total number of flows from source IP address i to destination IP address j;

[0027] The port change rate is calculated as follows:

[0028] The formula for the port change rate within the acquisition period T is:

[0029]

[0030] Where PostsNum represents the total number of destination ports detected within the collection period T;

[0031] The network protocol change rate is calculated as follows:

[0032] The formula for the network protocol change rate within the acquisition period T is:

[0033]

[0034] ProtocolNum represents the total number of network protocols in the collection period T.

[0035] Furthermore, in step S3, constructing an undirected graph structure of network traffic according to the actual network topology includes:

[0036] The SDN controller periodically detects the link relationship between each SDN switch in the network, maintains a complete network topology by using a link discovery protocol, and constructs a network traffic undirected graph structure according to the complete network topology; in the undirected graph structure, each node represents an actual SDN switch, each edge represents an actual forwarding path of traffic, and an edge traffic eigenvalue is calculated.

[0037] Further, calculating the edge traffic eigenvalue with the characteristic of abnormal attack traffic for each edge includes that the edge traffic eigenvalue includes a link throughput and a link delay;

[0038] The link throughput is calculated as follows:

[0039] The formula of the link throughput in a collection period T is defined as:

[0040]

[0041] wherein SendBytes represents the number of sent bytes of the link in the collection period T, ReceiveBytes represents the number of received bytes of the link in the collection period T, ST T represents the sending throughput, RT T represents the receiving throughput, and LT T represents the overall throughput of the link.

[0042] The link delay is calculated as follows:

[0043] The formula of the link delay in a collection period T is defined as:

[0044]

[0045] wherein RTT S represents the average sending delay of each data packet in the link in the collection period T, and RTT R represents the average receiving delay of each data packet in the link in the collection period T.

[0046] Further, step S4 includes:

[0047] An initial input graph of the graph neural network is constructed.

[0048] In the initial input graph, each node has a feature vector, which is a node traffic eigenvalue, representing the feature of the node; each edge also has a feature vector, which is an edge traffic eigenvalue, representing the feature of the edge.

[0049] A graph convolution layer is constructed.

[0050] After L-layer graph convolution operations, the final feature representation of each node is obtained.

[0051] A fully connected layer is constructed to map the node features output by the graph convolution layer to a classification space.

[0052] A binary classification cross-entropy loss function is used as the loss function for training the model.

[0053] Further, the initial input graph is specifically as follows:

[0054] The network traffic undirected graph is represented as:

[0055] G = (V, E)

[0056] Wherein, V represents a node set, and a node v E V represents an SDN switch in the network; E represents an edge set, and an edge e ij E represents a connection between switches v i and v j .

[0057] Each node has a feature vector x i E X d , which is calculated by step S2, represents the node traffic feature value, and the node feature matrix X E R |V|×d , wherein d is the dimension of the node feature, and each edge also has a feature vector r ij E R f , which is calculated by step S3, represents the edge flow feature value of the edge, and the matrix of all edge features is E E R |E|×f , wherein f is the edge feature dimension.

[0058] Further, in step S4, the combined undirected graph structure is input into the GNN model for modeling to obtain a network anomaly attack behavior detection model, which includes:

[0059] A graph convolution layer is constructed, and the role of the graph convolution layer is to combine the node traffic feature value of each node with the node traffic feature value of its neighbor node and the edge flow feature value of the adjacent edge, update the node representation, and the formula of the graph convolution operation is as follows:

[0060]

[0061] Wherein:

[0062] is the feature representation of node v i in the lth layer, and initially

[0063] is the feature representation of edge (i, j) in the lth layer, and initially

[0064] W (l) is a learnable weight matrix of the node feature, and F (l)is a learnable weight matrix of edge features;

[0065] is a ReLU activation function;

[0066] After L-layer graph convolution operations, the final feature representation of each node is obtained That is, the final node feature matrix H is obtained (L) is:

[0067]

[0068] The full connection layer is constructed to map the node features output by the graph convolution layer to the classification space; in the full connection layer, the nodes are binary classified to distinguish whether the nodes are forwarding abnormal attack traffic; the formula of the full connection layer operation is as follows:

[0069]

[0070] wherein:

[0071] is a learnable weight matrix of the full connection layer;

[0072] b o is a bias term;

[0073] is a Sigmoid activation function for outputting a binary classification probability;

[0074] is the predicted value of node v i , indicating the probability of whether the node is abnormal;

[0075] The network anomaly attack behavior detection model is trained to obtain the trained network anomaly attack behavior detection model, which includes:

[0076] A binary classification cross-entropy loss function is used as the loss function of the training model, and the formula is as follows:

[0077]

[0078] wherein y i is the true label of node v i , wherein 0 represents a normal node and 1 represents an abnormal node, is the predicted probability of the model for node v i .

[0079] Further, step S5 includes:

[0080] When new network traffic data needs to be detected, it is necessary to convert the new network traffic data into a graph structure similar to the training data used in the training process of the network abnormal attack behavior detection model. The trained network abnormal attack behavior detection model predicts the node abnormality probability, that is, the SDN switch abnormality probability. If the abnormality probability is greater than or equal to the set value, it is considered that the SDN switch is forwarding abnormal attack traffic and the SDN controller alarm mechanism is triggered; if the abnormality probability is less than the set value, it is considered that the SDN switch is not forwarding abnormal attack traffic and the SDN controller alarm mechanism is not triggered.

[0081] Compared with the prior art, the beneficial effects of the technical solution of the present invention are:

[0082] This paper combines SDN and GNN, utilizing the dynamic network management capabilities of SDN and the advantages of GNN in complex data pattern recognition, aiming to improve the accuracy and real-time performance of detecting abnormal network attack behaviors. By using GNN to model complex network topologies and the relationships between nodes, various types of abnormal network attack behaviors can be effectively detected. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] Figure 1 This is a flow chart of the method for detecting abnormal network attack behavior based on SDN and graph neural network according to Example 1;

[0084] Figure 2 The SDN network topology diagram of the network abnormal attack behavior detection method based on SDN and graph neural network described in Example 3;

[0085] Figure 3 This is a graph neural network model diagram of the network abnormal attack behavior detection method based on SDN and graph neural network described in Example 3; DETAILED DESCRIPTION

[0086] The accompanying drawings are for illustrative purposes only and are not to be construed as limiting this patent;

[0087] The technical solution of the present invention is further described below with reference to the accompanying drawings and embodiments.

[0088] Example 1:

[0089] This embodiment provides Figure 1 The network abnormal attack behavior detection method based on SDN and graph neural network includes:

[0090] S1: Collect traffic data stored by the SDN switch according to the SDN controller;

[0091] S2: Based on the traffic data, calculate the node traffic characteristic value on each SDN switch that has the characteristics of abnormal attack traffic;

[0092] S3: Based on the actual network topology, an undirected graph structure of network traffic is constructed: the nodes in the undirected graph structure represent the actual SDN switches, and the edges represent the actual forwarding paths of the traffic. The edge traffic feature value of each edge is calculated to represent the characteristics of abnormal attack traffic.

[0093] S4: combining the node traffic characteristic value and the edge traffic characteristic value with the undirected graph structure to obtain a combined undirected graph structure; inputting the combined undirected graph structure into the GNN model for modeling to obtain a network abnormal attack behavior detection model; training the network abnormal attack behavior detection model to obtain a trained network abnormal attack behavior detection model;

[0094] S5: Detect the newly collected traffic data through the trained network abnormal attack behavior detection model to obtain the detection results.

[0095] This embodiment combines SDN and GNN, leveraging the dynamic network management capabilities of SDN and the advantages of GNN in complex data pattern recognition. It aims to improve the accuracy and real-time performance of detecting abnormal network attack behaviors. By using GNN to model complex network topologies and the relationships between nodes, it can effectively detect various types of abnormal network attack behaviors.

[0096] Example 2:

[0097] This embodiment further discloses the following on the basis of the first embodiment:

[0098] Furthermore, in step S1, it includes: the SDN controller regularly collects traffic data of all SDN switches in the network through the OpenFlow protocol, and summarizes and integrates the traffic data, wherein the traffic data includes at least one of the following: traffic metadata, traffic path and traffic size; wherein the traffic path includes at least one of the following: source IP address and destination IP address.

[0099] Furthermore, in step S2, the node traffic characteristic value includes at least one of the following: the average number of bytes of data flow of the SDN switch, the average duration of data flow, the entropy of the source IP address, the port change rate, and the network protocol change rate.

[0100] Furthermore, in step S2, it includes:

[0101] The average number of bytes of the data stream is calculated as follows:

[0102] The formula for the average number of bytes of data stream within the acquisition period T is:

[0103]

[0104] Wherein, FlowNum represents the total number of flows in the collection period T, BytesNum represents the number of bytes of data packets of each flow;

[0105] The average duration of the data flow is calculated as follows:

[0106] The average duration of the data flow in the collection period T is calculated as follows:

[0107]

[0108] Wherein, FlowNum represents the total number of flows in the collection period T, DurationTime represents the survival time of each flow;

[0109] The entropy of the source IP address is calculated as follows:

[0110] The entropy of the source IP address in the collection period T is calculated as follows:

[0111]

[0112] Wherein, FlowNum j represents the total number of flows with j as the destination IP address in the collection period T, IP ij represents the total number of flows from the source IP address i to the destination IP address j;

[0113] The port change rate is calculated as follows:

[0114] The port change rate in the collection period T is calculated as follows:

[0115]

[0116] Wherein, PostsNum represents the total number of destination ports detected in the collection period T;

[0117] The network protocol change rate is calculated as follows:

[0118] The network protocol change rate in the collection period T is calculated as follows:

[0119]

[0120] Wherein, ProtocolNum represents the total number of network protocols in the collection period T.

[0121] Further, in step S3, according to the actual network topology, the undirected graph structure of network traffic is constructed, including:

[0122] The SDN controller periodically detects the link relationship between each SDN switch in the network, maintains a complete network topology by using a link discovery protocol, and constructs a network traffic undirected graph structure according to the complete network topology; in the undirected graph structure, each node represents an actual SDN switch, each edge represents an actual forwarding path of traffic, and an edge traffic eigenvalue is calculated.

[0123] Further, calculating the edge traffic eigenvalue with the characteristic of abnormal attack traffic for each edge includes that the edge traffic eigenvalue includes a link throughput and a link delay.

[0124] The link throughput is calculated as follows:

[0125] The formula of the link throughput in the collection period T is defined as:

[0126]

[0127] wherein SendBytes represents the number of sent bytes of the link in the collection period T, ReceiveBytes represents the number of received bytes of the link in the collection period T, ST T represents the sending throughput, RT T represents the receiving throughput, and LT T represents the overall throughput of the link.

[0128] The link delay is calculated as follows:

[0129] The formula of the link delay in the collection period T is defined as:

[0130]

[0131] wherein RTT S represents the average sending delay of each data packet in the link in the collection period T, and RTT R represents the average receiving delay of each data packet in the link in the collection period T.

[0132] Further, step S4 includes:

[0133] Constructing an initial input graph of the graph neural network;

[0134] In the initial input graph, each node has a feature vector, which is a node traffic eigenvalue, representing the feature of the node; each edge also has a feature vector, which is an edge traffic eigenvalue, representing the feature of the edge.

[0135] Constructing a graph convolution layer;

[0136] After L-layer graph convolution operations, the final feature representation of each node is obtained.

[0137] Construct a fully connected layer to map the node features output by the graph convolution layer to the classification space;

[0138] The binary cross entropy loss function is used as the loss function for training the model.

[0139] Furthermore, the initial input graph is as follows:

[0140] The network traffic undirected graph is represented as:

[0141] G=(V,E)

[0142] Where V represents the node set, node v∈V represents the SDN switch in the network; E represents the edge set, edge e ij ∈E represents switch v i and v j connections between;

[0143] Each node has a feature vector x i ∈X d , calculated in step S2, represents the node traffic characteristic value, and the node characteristic matrix X∈R |V|×d , where d is the dimension of the node features, and each edge also has a feature vector r ij ∈R f , calculated in step S3, represents the edge flow characteristic value of the edge, and the matrix of all edge characteristics is E∈R |E|×f , where f is the edge feature dimension.

[0144] Furthermore, in step S4, the combined undirected graph structure is input into the GNN model for modeling, and the network abnormal attack behavior detection model obtained includes:

[0145] Construct a graph convolution layer. The function of the graph convolution layer is to combine the node flow characteristic value of each node with the node flow characteristic value of its neighboring nodes and the edge flow characteristic value of the adjacent edges to update the node representation. The formula of the graph convolution operation is as follows:

[0146]

[0147] in:

[0148] is node v i In the feature representation of the lth layer, initially

[0149] is the feature representation of edge (i, j) at layer l. Initially

[0150] W (l) is the learnable weight matrix of node features, F (l)is the learnable weight matrix of edge features;

[0151] σ is the ReLU activation function;

[0152] After L layers of graph convolution operations, the final feature representation of each node is obtained That is, the final node feature matrix H (L) for:

[0153]

[0154] Construct a fully connected layer to map the node features output by the graph convolution layer to the classification space. In the fully connected layer, perform binary classification on the nodes to distinguish whether the node is forwarding abnormal attack traffic. The formula for the fully connected layer operation is as follows:

[0155]

[0156] in:

[0157] is the learnable weight matrix of the fully connected layer;

[0158] b o ∈R is the bias term;

[0159] σ is the Sigmoid activation function, which is used to output the binary classification probability;

[0160] is node v i The predicted value of indicates the probability of whether the node is abnormal;

[0161] The network abnormal attack behavior detection model is trained to obtain the following:

[0162] The binary cross entropy loss function is used as the loss function for the training model. Its formula is as follows:

[0163]

[0164] Among them, y i is node v i The true label of , where 0 represents a normal node and 1 represents an abnormal node, is the model for node v i The predicted probability of .

[0165] Furthermore, step S5 includes:

[0166] When new network traffic data needs to be detected, it is necessary to convert the new network traffic data into a graph structure similar to the training data used in the training process of the network abnormal attack behavior detection model. The trained network abnormal attack behavior detection model predicts the node abnormality probability, that is, the SDN switch abnormality probability. If the abnormality probability is greater than or equal to the set value, it is considered that the SDN switch is forwarding abnormal attack traffic and the SDN controller alarm mechanism is triggered; if the abnormality probability is less than the set value, it is considered that the SDN switch is not forwarding abnormal attack traffic and the SDN controller alarm mechanism is not triggered.

[0167] This embodiment combines SDN and GNN, leveraging the dynamic network management capabilities of SDN and the advantages of GNN in complex data pattern recognition. It aims to improve the accuracy and real-time performance of detecting abnormal network attack behaviors. By using GNN to model complex network topologies and the relationships between nodes, it can effectively detect various types of abnormal network attack behaviors.

[0168] Example 3:

[0169] This embodiment provides a specific implementation scenario. The SDN controller uses the Opendaylight controller. The southbound protocol between the controller and the switch is the OpenFlow protocol. The Net_1 network connected to the switch Switch_1 contains 15 hosts, and the Net_2 network connected to the switch Switch_2 contains 5 hosts. Net_1 is the message sending network, and Net_2 is the attacked network. Net_1 can send abnormal attack traffic or normal messages to Net_2. Use abnormal traffic attack tools such as hping3 and nMap to send DDoS, port scanning and other attack packets from the Net_1 network to a specific host on the Net_2 network. See the attached network topology diagram. Figure 2 .

[0170] This embodiment provides a method for detecting abnormal network attack behavior based on SDN and graph neural network, the method comprising the following steps:

[0171] S1: Based on the SDN controller, collect the flow table information saved by the SDN switch, as follows:

[0172] The SDN controller regularly uses the OpenFlow protocol to collect flow table data from all SDN switches in the network, summarizes and integrates this data, and extracts basic metadata of network traffic, such as source IP address, destination IP address, flow size, flow number, and other information.

[0173] S2: Based on the traffic data collected by the SDN controller, calculate the traffic feature values ​​on each SDN switch that characterize abnormal network attack behavior, including the average number of bytes in the data flow, the average duration of the data flow, the entropy of the source IP address, the port change rate, and the network protocol change rate. These features can be calculated using the following formula.

[0174] The formula for defining the average number of bytes of data stream within the acquisition period T is:

[0175]

[0176] Where FlowNum represents the total number of flows in the collection period T, and BytesNum represents the number of bytes in the data packet of each flow;

[0177] DDoS attacks are a typical example of abnormal network attack behavior. The number of bytes in their data packets is usually small (such as SYN Flood), which can maximize the attack efficiency. Therefore, the average number of bytes in the data flow can be used as a characteristic value to distinguish normal traffic from abnormal attack traffic.

[0178] The formula for defining the average duration of data flow within the acquisition period T is:

[0179]

[0180] Where FlowNum represents the total number of flows within the collection period T, and DurationTime represents the lifetime of each flow;

[0181] According to the OpenFlow protocol, a switch's flow table entries are deleted if they remain unmatched for a time threshold. Abnormal attack traffic may generate random source IP addresses, which can easily trigger this mechanism, resulting in a short data flow duration. Therefore, the average data flow duration can be used as a characteristic value to distinguish normal traffic from abnormal attack traffic.

[0182] The entropy formula for the source IP address within the collection period T is defined as:

[0183]

[0184] Among them, FlowNum j Indicates the total number of flows with IP address j as the destination within the collection period T, IP ij Indicates the total number of flows from source IP address i to destination IP address j;

[0185] When abnormal attack traffic is generated, a large number of different IP addresses may be randomly generated as source IP addresses, resulting in an entropy value much higher than that of normal traffic. Therefore, the entropy of the source IP address can be used as a characteristic value to distinguish normal traffic from abnormal attack traffic.

[0186] The formula for defining the port change rate within the acquisition period T is:

[0187]

[0188] Where PostsNum represents the total number of destination ports detected within the collection period T;

[0189] When abnormal attack traffic is generated, a large number of different destination port numbers may be randomly generated, causing the destination port to change significantly faster as the attack continues. Therefore, the port change rate can be used as a characteristic value to distinguish normal traffic from abnormal attack traffic.

[0190] The formula for defining the network protocol change rate within the acquisition period T is:

[0191]

[0192] Among them, ProtocolNum represents the total number of network protocols in the collection period T;

[0193] When abnormal attack traffic is generated, unusual or unauthorized network protocol traffic may appear on the network. Therefore, the network protocol change rate can be used as a characteristic value to distinguish normal traffic from abnormal attack traffic.

[0194] S3: Based on the actual network topology, an undirected graph structure of network traffic is constructed, where nodes represent actual SDN switches and edges represent the actual forwarding paths of traffic. The traffic feature values ​​on each edge are then calculated. These feature values ​​can reflect the characteristics of abnormal traffic, including link throughput and link latency. These features can be calculated using the following formula.

[0195] The formula for defining the link throughput within the acquisition period T is:

[0196]

[0197] Among them, SendBytes represents the number of bytes sent by the link within the collection period T, ReceiveBytes represents the number of bytes received by the link within the collection period T, ST T Indicates the sending throughput, RT T Indicates the receiving throughput, LT T Indicates the overall link throughput;

[0198] When abnormal attack traffic is generated, it may cause a surge in network link throughput. Therefore, link throughput can be used as a characteristic value to distinguish normal traffic from abnormal attack traffic.

[0199] The formula for defining the link delay within the acquisition period T is:

[0200]

[0201] where RTT S denotes the average sending delay of each data packet in the link within the collection period T, RTT R denotes the average receiving delay of each data packet in the link within the collection period T.

[0202] When abnormal attack traffic is generated, it can cause the link delay to grow, so the link delay can be used as a characteristic value to distinguish normal traffic and abnormal attack traffic.

[0203] S4: Fill the traffic characteristic values generated by S2 and S3 into the nodes and edges of the network traffic undirected graph respectively, and then input the graph structure into the graph neural network (GNN) for modeling. The model is as shown in Figure 3 GNN can capture the spatial characteristics and dependencies in network traffic by passing the information of nodes and edges in the graph, so as to more effectively identify potential abnormal attack behaviors in the network. The specific steps are as follows:

[0204] S4.1: The network traffic undirected graph is represented as:

[0205] G = (V, E)

[0206] where V represents the node set, and node v e V represents an SDN switch in the network; E represents the edge set, and edge e ij e E represents the connection between switches v i and v j .

[0207] S4.2: Each node has a feature vector x i e X d , which is calculated by step S2 and represents the characteristics of the node. The node feature matrix X e R |V|×d , where d is the dimension of the node feature. Each edge also has a feature vector r ij e R f , which is calculated by step S3 and represents the characteristics of the edge. The matrix of all edge features is E e R |E|×f , where f is the dimension of the edge feature.

[0208] S4.3: Build a graph convolution layer (GCN Layer), which is used to combine the features of each node with the features of its neighbor nodes and neighbor edges, and update the node representation. The formula of the graph convolution operation is as follows:

[0209]

[0210] where:

[0211] is node v i In the feature representation of the lth layer, initially

[0212] is the feature representation of edge (i, j) at layer l. Initially

[0213] W (l) is the learnable weight matrix of node features, F (l) is the learnable weight matrix of edge features;

[0214] σ is the ReLU activation function;

[0215] S4.4: After L layers of graph convolution operations, the final feature representation of each node is obtained That is, the final node feature matrix H (L) for:

[0216]

[0217] S4.5: Build a fully connected layer to map the node features output by the graph convolutional layer to the classification space. In the fully connected layer, we need to perform binary classification on the nodes to distinguish whether the node is forwarding abnormal attack traffic. The formula for the fully connected layer operation is as follows:

[0218]

[0219] in:

[0220] is the learnable weight matrix of the fully connected layer;

[0221] b o ∈R is the bias term;

[0222] σ is the Sigmoid activation function, which is used to output the binary classification probability;

[0223] is node v i The predicted value of , which indicates the probability of whether the node is abnormal.

[0224] S4.6: Use the binary cross entropy loss function as the loss function for the training model. The formula is as follows:

[0225]

[0226] Among them, y i is node v i The true label (0 represents a normal node, 1 represents an abnormal node), is the model for node v i The predicted probability of .

[0227] S5: When new network traffic needs to be detected, it is first converted into a graph structure similar to the training data, and the abnormal probability of the node (SDN switch) is predicted by the model. If the probability exceeds 0.5, it is judged that the SDN switch may be forwarding abnormal attack traffic, triggering the alarm mechanism of the SDN controller, and taking corresponding response measures according to the preset strategy, such as limiting traffic, re-routing or blocking malicious traffic, to ensure the stability and security of the network.

[0228] The embodiment combines SDN and GNN, uses the dynamic network management capability of SDN and the advantage of GNN in complex data pattern recognition, aims to improve the accuracy and real-time performance of network abnormal attack behavior detection, models the complex network topology and the association between nodes by GNN, and effectively detects various types of network abnormal attack behaviors.

[0229] Obviously, the above embodiments of the application are only examples for clearly illustrating the application, and are not intended to limit the implementation modes of the application. Based on the above description, other different forms of changes or variations can be made by those skilled in the art. Here, it is not necessary and impossible to enumerate all the implementation modes. Any modification, equivalent replacement and improvement made within the spirit and principle of the application shall be included in the protection scope of the claims of the application.

Claims

1. A method for detecting abnormal network attack behaviors based on SDN and graph neural network, characterized in that: include: S1: Collect traffic data stored by the SDN switch according to the SDN controller; S2: Based on the traffic data, calculate the node traffic characteristic value on each SDN switch that has the characteristics of abnormal attack traffic; S3: Based on the actual network topology, an undirected graph structure of network traffic is constructed: the nodes in the undirected graph structure represent the actual SDN switches, and the edges represent the actual forwarding paths of the traffic. The edge traffic feature value of each edge is calculated to represent the characteristics of abnormal attack traffic. S4: combining the node flow characteristic value and the edge flow characteristic value with the undirected graph structure to obtain a combined undirected graph structure; The combined undirected graph structure is input into the GNN model for modeling to obtain a network abnormal attack behavior detection model; Training the network abnormal attack behavior detection model to obtain a trained network abnormal attack behavior detection model; The combined undirected graph structure is input into the GNN model for modeling, and the network abnormal attack behavior detection model obtained includes: Construct a graph convolution layer. The function of the graph convolution layer is to combine the node flow characteristic value of each node with the node flow characteristic value of its neighboring nodes and the edge flow characteristic value of the adjacent edges to update the node representation. The formula of the graph convolution operation is as follows: in: is node v i In the feature representation of the lth layer, initially is the feature representation of edge (i, j) at layer l. Initially W (l) is the learnable weight matrix of node features, F (l) is the learnable weight matrix of edge features; σ is the ReLU activation function; After L layers of graph convolution operations, the final feature representation of each node is obtained That is, the final node feature matrix H (L) for: Construct a fully connected layer to map the node features output by the graph convolution layer to the classification space. In the fully connected layer, perform binary classification on the nodes to distinguish whether the node is forwarding abnormal attack traffic. The formula for the fully connected layer operation is as follows: in: is the learnable weight matrix of the fully connected layer; b o ∈R is the bias term; σ is the Sigmoid activation function, which is used to output the binary classification probability; is node v i The predicted value of indicates the probability of whether the node is abnormal; The network abnormal attack behavior detection model is trained to obtain the following: The binary cross entropy loss function is used as the loss function for the training model. Its formula is as follows: Among them, y i is node v i The true label of , where 0 represents a normal node and 1 represents an abnormal node, is the model for node v i The predicted probability of S5: Detect the newly collected traffic data through the trained network abnormal attack behavior detection model to obtain the detection results.

2. The method for detecting abnormal network attack behaviors based on SDN and graph neural network according to claim 1 is characterized in that: In step S1, it includes: the SDN controller regularly collects traffic data of all SDN switches in the network through the OpenFlow protocol, and summarizes and integrates the traffic data, wherein the traffic data includes at least one of the following: traffic metadata, traffic path and traffic size; wherein the traffic path includes at least one of the following: source IP address and destination IP address.

3. The method for detecting abnormal network attack behaviors based on SDN and graph neural network according to claim 1 is characterized in that: In step S2, the node traffic characteristic value includes at least one of the following: the average number of bytes of data flow of the SDN switch, the average duration of data flow, the entropy of the source IP address, the port change rate, and the network protocol change rate.

4. The method for detecting abnormal network attack behaviors based on SDN and graph neural network according to claim 3 is characterized in that: In step S2, it includes: The average number of bytes of the data stream is calculated as follows: The formula for the average number of bytes of data stream within the acquisition period T is: Where FlowNum represents the total number of flows in the collection period T, and BytesNum represents the number of bytes in the data packet of each flow; The average duration of the data stream is calculated as follows: The formula for the average duration of data flow within the acquisition period T is: Where FlowNum represents the total number of flows within the collection period T, and DurationTime represents the lifetime of each flow; The entropy of the source IP address is calculated as follows: The entropy formula of the source IP address within the collection period T is: Among them, FlowNum j Indicates the total number of flows with IP address j as the destination within the collection period T, IP ij Indicates the total number of flows from source IP address i to destination IP address j; The port change rate is calculated as follows: The formula for the port change rate within the acquisition period T is: Where PostsNum represents the total number of destination ports detected within the collection period T; The network protocol change rate is calculated as follows: The formula for the network protocol change rate within the acquisition period T is: ProtocolNum represents the total number of network protocols in the collection period T.

5. The method for detecting abnormal network attack behaviors based on SDN and graph neural network according to claim 1 is characterized in that: In step S3, based on the actual network topology, constructing an undirected graph structure of network traffic includes: The SDN controller regularly detects the link relationships between various SDN switches in the network, uses the link discovery protocol to maintain the complete network topology, and constructs an undirected graph structure of network traffic based on the complete network topology; in the undirected graph structure, each node represents the actual SDN switch, each edge represents the actual forwarding path of the traffic, and the edge traffic characteristic value is calculated.

6. The method for detecting abnormal network attack behaviors based on SDN and graph neural network according to claim 1 is characterized in that: Calculating edge traffic feature values ​​of each edge that characterize abnormal attack traffic characteristics includes: edge traffic feature values ​​include: link throughput and link delay; The link throughput is calculated as follows: The formula for defining the link throughput within the acquisition period T is: Among them, SendBytes represents the number of bytes sent by the link within the collection period T, ReceiveBytes represents the number of bytes received by the link within the collection period T, ST T Indicates the sending throughput, RT T Indicates the receiving throughput, LT T Indicates the overall link throughput; The link delay is calculated as follows: The formula for defining the link delay within the acquisition period T is: Among them, RTT S Indicates the average transmission delay of each data packet in the link during the collection period T, RTT R It represents the average receiving delay of each data packet in the link during the acquisition period T.

7. The method for detecting abnormal network attack behaviors based on SDN and graph neural network according to claim 1 is characterized in that: Step S4 includes: Construct the initial input graph of the graph neural network; In the initial input graph, each node has a feature vector, which is the node flow feature value, representing the node's characteristics; each edge also has a feature vector, which is the edge flow feature value, representing the edge's characteristics; Construct graph convolutional layer; After L layers of graph convolution operations, the final feature representation of each node is obtained; Construct a fully connected layer to map the node features output by the graph convolution layer to the classification space; The binary cross entropy loss function is used as the loss function for training the model.

8. The method for detecting abnormal network attack behaviors based on SDN and graph neural network according to claim 7 is characterized in that: The initial input graph is as follows: The network traffic undirected graph is represented as: G=(V,E) Where V represents the node set, node v∈V represents the SDN switch in the network; E represents the edge set, edge e ij ∈E represents switch v i and v j connections between; Each node has a feature vector x i ∈X d , calculated in step S2, represents the node traffic characteristic value, and the node characteristic matrix X∈R |V|×d , where d is the dimension of the node features, and each edge also has a feature vector r ij ∈R f , calculated in step S3, represents the edge flow characteristic value of the edge, and the matrix of all edge characteristics is E∈R |E|×f , where f is the edge feature dimension.

9. The method for detecting abnormal network attack behaviors based on SDN and graph neural network according to claim 1 is characterized in that: Step S5 includes: When new network traffic data needs to be detected, it is necessary to convert the new network traffic data into a graph structure similar to the training data used in the training process of the network abnormal attack behavior detection model. The trained network abnormal attack behavior detection model predicts the node abnormality probability, that is, the SDN switch abnormality probability. If the abnormality probability is greater than or equal to the set value, it is considered that the SDN switch is forwarding abnormal attack traffic and the SDN controller alarm mechanism is triggered; if the abnormality probability is less than the set value, it is considered that the SDN switch is not forwarding abnormal attack traffic and the SDN controller alarm mechanism is not triggered.

Images