Dynamic graph-oriented abnormal network community detection method

Abstract

The invention discloses an abnormal network community detection method for a dynamic graph, and relates to the technical field of anomaly detection, and the method comprises the steps: obtaining network communication flow data of each time period, drawing a network communication flow graph, and constructing a network dynamic graph model; dividing nodes in the network communication flow graph of each time period to obtain a community set; community matching is carried out based on the network communication flow graphs of the adjacent time periods, and associated community pairs between the adjacent time periods are obtained; on the basis of the associated community pair, the distance of the associated community pair is calculated, whether the distance of the associated community pair is larger than the self-adaptive threshold value or not is judged, and therefore whether the community is abnormal or not is judged, and compared with monitoring of behaviors of a single node or edge in a large-scale network graph structure, calculation complexity is reduced, and detection precision is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of anomaly detection, and in particular to an abnormal network community detection method oriented to a dynamic graph. Background Art

[0002] Complex networks carry a large number of nodes and the interactive relationships between nodes. The influx of malicious users makes complex networks face the threat of attacks, posing a huge hidden danger to network security. Therefore, it is particularly important to detect abnormal behaviors in complex networks in a timely and accurate manner.

[0003] Most existing network anomaly detection methods mainly identify abnormal nodes or edges. However, complex networks carry a large number of nodes and complex interactive relationships. The computational complexity of monitoring the behavior of a single node or edge in such a large-scale graph structure is relatively high. At the same time, the current feature extraction methods of network structures are relatively complex, and there is a lack of efficient similarity measurement methods in large-scale data sets. Therefore, when the distinction between frequent anomalies is small, the accuracy is low. Feature extraction relies too much on global structural information and ignores local details in the network, making it difficult to effectively detect local abnormal events. Summary of the invention

[0004] In order to overcome the defects of high computational complexity and low detection accuracy in the above-mentioned prior art, the present invention proposes an abnormal network community detection method for dynamic graphs.

[0005] To achieve the above object, the present invention adopts the following technical scheme, a method for detecting abnormal network communities for dynamic graphs, comprising: S1: Obtain network communication flow data for each time period, draw a network communication flow graph for each time period, and construct a network dynamic graph model, wherein the network dynamic graph model is composed of network communication flow graphs arranged in order of time periods; S2, divide the nodes in the network communication flow graph in each time period to obtain the community set; S3, performing community matching based on the network communication flow graph of adjacent time periods to obtain associated community pairs between adjacent time periods; S4, calculate the distances of associated community pairs; S5: Determine whether the distance between the associated community pairs is greater than the adaptive threshold; if so, it indicates that an abnormality occurs in the community in the latter time period of the associated community pair; if not, it indicates that the community in the associated community pair is normal.

[0006] Preferably, in step S2, the nodes in the network communication flow graph of each time period are divided to obtain a community set, including: S21: Segment each network communication flow graph to obtain a number of segmented communities; S22: split and merge the divided communities multiple times to explore all possible ways of dividing the communities; S23: Calculate the modularity density for each partitioning method, find the partitioning method with the maximum modularity density, and mark the non-overlapping communities formed by the partitioning method with the maximum modularity density as the optimal non-overlapping communities, thereby forming a community set. , where C t is the community set formed in the tth time period, represents the qth community in the tth time period, and m is the total number of communities.

[0007] Preferably, the calculation process of the modularity density includes: C1: For each division method, the modularity Q is obtained based on multiple communities. The calculation formula of modularity Q is: ; Among them, C is the community set, c i is the ith community in C, is the number of edges between nodes in the ith community, is the number of edges from nodes in the ith community to nodes outside the ith community, |E| is the total number of edges in the network communication flow graph; C2: Calculate the segmentation penalty SP based on multiple communities. The calculation formula of the segmentation penalty SP is: ; in, represents the number of edges connecting the i-th community and the j-th community; C3: Obtain modularity density Q based on modularity and segmentation penalty ds , modularity density Q ds The calculation formula is: ; in, is the density within the i-th community; is the density between the i-th community and the j-th community.

[0008] Preferably, in step S3, performing community matching based on the network communication flow graph of adjacent time periods to obtain associated community pairs between adjacent time periods includes: S31: Two communities based on adjacent time periods , , calculate the similarity J between two communities pq , the formula is: ; in, For the community and community The number of overlapping nodes, For the community With the community The sum of the number of nodes; is the pth community in the t-1th time period, is the qth community in the tth time period; S32: Compare the similarity between the two communities with a set threshold, obtain several communities in the t-th time period corresponding to the p-th community in the t-1-th time period that exceed the set threshold, and mark them as communities to be selected; S33: Find the community with the highest similarity with the pth community in the t-1th time period among the communities to be selected, and use it as the community associated with the pth community in the t-1th time period, so as to obtain the associated community pairs between adjacent time periods. .

[0009] Preferably, in step S4, calculating the distance between the associated community pairs includes: S41: Associated communities based on all matches , get the Laplace matrix and ; S42: Laplacian Matrix and Perform feature extraction to obtain the NetLSD vector and ; S43: Based on NetLSD vector and Get the distance d between the associated community pairs t ; in, is the pth community in the t-1th time period, is the qth community in the tth time period; and are the Laplace matrices of the t-1th time period and the tth time period respectively; and They are and The network Laplace spectrum describes the vector; d t For the associated community distance.

[0010] Preferably, in step S5, the step of obtaining the adaptive threshold comprises: SS1: Based on the distance d between the associated community pairs in the t-2th time period and the t-1th time period t-1, get the distance prediction value of the associated community pair between the t-1th time period and the tth time period , the calculation formula is: ; Where α is the smoothing coefficient and 0<α<1, is the predicted distance value of the associated community pair between the t-2th time period and the t-1th time period; SS2: Calculate the distance mean avg and distance standard deviation V of the associated community pairs in the sliding window. The calculation formulas are: ; Among them, k is the size of the sliding window, t is the time period number, and d x is the distance between the associated community pairs in the x-1th time period and the xth time period, x=t-k+1,...,t; SS3: Distance prediction based on associated community pairs And the distance standard deviation V of the associated community pairs in the sliding window, obtain the adaptive threshold U t , the calculation formula is: ; Among them, β is the standard deviation coefficient.

[0011] Preferably, the and The calculation formulas are: ; Among them, |c i | is the number of nodes in the i-th community.

[0012] Preferably, in step S1, the time is divided according to fixed time intervals to form multiple time periods. In each time period, the IP of each host in the network communication is abstracted as a node, and the network communication between nodes is abstracted as an edge, thereby forming a network communication flow graph.

[0013] Preferably, in step S21, the network communication flow graph for each time period is segmented to obtain a plurality of segmented communities, each of which contains at least one node.

[0014] Preferably, the distance d between the associated community pairs is t The calculation formula is: ; in, Represents the 2-norm operation.

[0015] The advantages of the present invention are: (1) The present invention divides the nodes in the network communication flow graph to obtain several optimal non-overlapping communities, and then obtains the associated community pairs between adjacent time periods based on the communities in different time periods. Based on the associated community pairs, it identifies whether there are abnormal network communities. Compared with monitoring the behavior of a single node or edge in a large-scale network graph structure, the present invention reduces the computational complexity and improves the accuracy of abnormal network community detection.

[0016] (2) The present invention divides the network communication flow graph of each time period to obtain several divided communities; splits and merges the several divided communities multiple times to explore all possible division methods, and calculates the modularity density for each division method. The several non-overlapping communities formed by the division method with the maximum modularity density are marked as the optimal several non-overlapping communities. This can prevent the community from being divided too small and avoid the resolution limitation problem, thereby ensuring the scientificity and rationality of the community division and making the subsequent anomaly detection of the network community more accurate.

[0017] (3) The present invention calculates the similarity between two communities through similar overlapping nodes between communities in different time periods, obtains the community to be selected based on the similarity, and finds the community with the highest similarity between the community to be selected and the pth community in the t-1th time period as the qth community in the tth time period associated with the pth community in the t-1th time period, thereby obtaining the associated community pair. ,By calculating the similarities of all possible pairs of communities in adjacent time periods, it is possible to identify which community in the previous time period is most similar to the next time period, thereby tracing the evolution path of the community over time, and the search efficiency is high.

[0018] (4) Based on the distance of the associated community pairs, the present invention obtains the distance mean avg and the distance standard deviation V of the associated community pairs in the sliding window, and dynamically adjusts the adaptive threshold based on the predicted value of the associated community distance and the distance standard deviation of the associated community pairs in the sliding window. Compared with the fixed threshold, which may ignore the dynamics of network traffic and cause false positives or negative positives, the adaptive threshold is dynamically adjusted according to the normal fluctuation range of the current network traffic, ensuring the rationality and real-time nature of the threshold setting, and effectively improving the accuracy and robustness of anomaly detection.

[0019] (5) The present invention can effectively detect abnormal communities in the network by calculating the distance between the associated community pairs and combining them with an adaptive threshold. The introduction of the adaptive threshold enables the method to adapt to changes in the network and improve the accuracy of detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a comparison chart of network anomalies; Figure 2 Forming process diagrams for network communication flow diagrams; Figure 3 Construct graphs for adjacent time period community discovery; Figure 4 It is a structural flow chart of the method of the present invention; Figure 5 is a flow chart of the steps of the method of the present invention; Figure 6 This is a comparison chart of the results of the method of the present invention and the NetLSD method. DETAILED DESCRIPTION

[0021] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] like Figure 1-5 As shown, the present invention proposes an abnormal network community detection method for dynamic graphs, comprising: S1: Acquire network communication flow data, draw a network communication flow graph, and construct a network dynamic graph model, wherein the network dynamic graph model is composed of a network communication flow graph arranged in time period order.

[0023] In network communication, hosts establish connections with other hosts by sending and receiving data packets. The network communication flow data exchanged between hosts is usually defined as a series of data packets with the same network triplet, including information such as the source host, destination host, and packet size.

[0024] The network is divided into multiple time periods according to fixed time intervals. In each time period, the IP address of each host in the network communication is abstracted as a node. i With node v j The network communication between them is abstracted into an edge e ij , thus forming a network communication flow graph , v and ε represent the set of nodes and edges respectively.

[0025] Build a network dynamic graph model based on the network communication flow graph of multiple time periods of the network communication flow , Represents the network communication flow graph in the tth time period, T is the last time period, e=(i,j,w)∈ε t Indicates that in the tth time period, the i-th node and the j-th node are connected in the network communication and the weight is w. w represents the closeness of the network communication connection between node i and node j. For unweighted graphs, w is always 1. For weighted graphs, w∈R+ .

[0026] Because the graph structure of the network is extracted from the network communication flow data, it is impossible to use the entire data set at once to create a unique static overall graph. Therefore, the data set needs to be divided into fixed time intervals, such as Figure 2 As shown, times t1, t2, t3, etc. are divided into a time period, and the network communication flow data at these times can be used to form a network communication flow graph.

[0027] Next, a dynamic graph model is constructed through the network communication flow graphs of multiple time periods, and the dynamic graph model is represented as , which is equivalent to splicing multiple static network sequences to form a dynamic network.

[0028] In this embodiment, in step S1, the fixed time interval is set to 5 minutes.

[0029] S2: Divide the nodes in the network communication flow graph in each time period to obtain the community set.

[0030] Subtle anomalies refer to deviations or irregularities that occur in small areas such as communities, among densely connected nodes in network communications. These deviations or irregularities are not easily detected by global analysis methods. Figure 1 It is difficult to observe that there are three malicious users committing fraud in a graph with a global structure. To this end, the present invention proposes an abnormal network community detection method for dynamic graphs.

[0031] In order to enhance the ability to detect subtle anomalies in the network, features are extracted from groups (i.e. communities) rather than from single nodes, edges, or the entire network communication flow graph. The time dimension and network structure must be considered here, because first of all, all community information must be extracted based on the given time series data, which requires the use of a community discovery algorithm. As time changes, the composition structure of the community changes, and the community information in each time period needs to be matched. At this time, community matching technology is needed. After the matching community is determined, the anomaly detection method is used to compare the changes in the associated communities in two adjacent time periods to determine whether there is a possibility of abnormality in the community.

[0032] In this embodiment, the community discovery algorithm Louvain is used to obtain a community set, including: S21: Segment the network communication flow graph in each time period to obtain a number of divided communities; S22: Perform multiple splits and mergers on the divided communities to explore all possible ways of dividing the communities; S23: Calculate the modularity density for each partitioning method, find the partitioning method with the maximum modularity density, and mark the non-overlapping communities formed by the partitioning method with the maximum modularity density as the optimal non-overlapping communities, thereby forming a community set. , where C t The community set formed by the t-th time period is composed of the node set v in the t-th time period t Split to get, represents the qth community in the tth time period, and m is the total number of communities.

[0033] The calculation method of the modularity density includes: C1: For each division method, the modularity Q is obtained based on multiple communities. The calculation formula of modularity Q is: ; Among them, C is the community set, c i is the ith community in C, is the number of edges between nodes in the ith community, is the number of edges from nodes in the ith community to nodes outside the ith community, and |E| is the total number of edges in the network communication flow graph.

[0034] Modularity Q is a metric used to evaluate the quality of community discovery, comparing the actual number of edges within a community with the expected number of edges in a random situation with the same number of nodes and degree sequence. The difference between these two values ​​forms the basis of the modularity metric. The general idea is that the divided community should show more and tighter connections than in a random situation. Therefore, a Q value close to 0 means that the result of this community discovery is close to a random assignment. The higher the Q value, the stronger the community structure.

[0035] C2: Calculate the segmentation penalty SP based on multiple communities. The calculation formula of the segmentation penalty SP is: ;

[0036] in, represents the number of edges connecting the i-th community and the j-th community.

[0037] C3: Obtain modularity density Q based on modularity and segmentation penalty ds , modularity density Q ds The calculation formula is: ;

[0038] in, is the density within the i-th community; is the density between the i-th community and the j-th community, which is the product of the number of edges connecting the i-th community and the j-th community divided by the number of nodes in the two communities.

[0039] and The calculation formulas are: ; Among them, |c i | is the number of nodes in the i-th community.

[0040] However, modularity has some limitations. It tends to merge small communities into large communities and cannot effectively identify smaller communities. This is called the resolution limitation problem. To alleviate this shortcoming, modularity density is obtained by mixing the split penalty and community density into modularity, and the optimal community division method is found through modularity density. At the same time, the split penalty can prevent the problem of the community obtained by community division being too small.

[0041] The divided communities may be a community set including a node, each community in the community set covers different nodes in the network, or may be divided communities obtained by other techniques, which are then optimized by the method of the present invention to obtain several non-overlapping communities formed by the division method when the modularity density is maximum.

[0042] The goal of community discovery is to identify closely connected groups of nodes in the network and treat closely connected groups of nodes as the same community, such as Figure 3 As shown, in each time period, the network communication flow diagram The node set v t It is divided into several non-overlapping communities, thus gaining a deeper understanding of group behavior and dynamics in the network.

[0043] S3: Perform community matching based on the network communication flow graph of adjacent time periods to obtain associated community pairs between adjacent time periods.

[0044] After community discovery, nodes in the network communication flow graph are assigned to communities. However, the numbers or labels of communities in different time periods may not correspond. Community matching techniques associate corresponding communities in adjacent time periods to understand their similarities and differences.

[0045] set up and Represents the network communication flow graph of the t-1th time period respectively And the network communication flow diagram for the tth time period The community set formed, among which, and Respectively The pth community and The community matching technology obtains the associated community pairs based on the similar overlapping nodes between communities in different time periods. .

[0046] Perform community matching based on network communication flow graphs in different time periods to obtain associated community pairs between adjacent time periods, including: S31: Two communities based on adjacent time periods , , calculate the similarity J between two communities pq , the formula is: ; in, For the community and community The number of overlapping nodes, For the community With the community The sum of the number of nodes; is the pth community in the t-1th time period, is the qth community in the tth time period; S32: Compare the similarity between the two communities with a set threshold, obtain several communities in the t-th time period corresponding to the p-th community in the t-1-th time period that exceed the set threshold, and mark them as communities to be selected; S33: Find the community with the highest similarity with the pth community in the t-1th time period among the communities to be selected, and use it as the community in the tth time period associated with the pth community in the t-1th time period, so as to obtain the associated community pairs between adjacent time periods. .

[0047] For any community in the t-1th time period , check its relationship with all communities in the tth time period If this similarity value exceeds the set threshold τ, the two communities are considered to have a corresponding relationship in the time series. When the similarity of multiple communities exceeds this threshold, the community with the highest similarity is selected as the matching community for the adjacent time period. The similarity value is between 0 and 1, where 0 means that the two communities in the adjacent time period have no common nodes and no corresponding relationship, and 1 means that the nodes in the two communities are the same. By calculating the similarity of all possible community pairs in adjacent time periods, it is possible to identify which community in the t-1th time period is most similar to the community in the tth time period, thereby tracking the evolution path of the community over time.

[0048] S4: Calculate the distance between the associated community pairs, including: S41: Associated communities based on all matches , get the Laplace matrix and ; S42: Laplacian Matrix and Perform feature extraction to obtain the NetLSD vector and ; S43: Based on NetLSD vector and Get the distance d between the associated community pairs t ; The distance d between the associated community pairs t The calculation formula is: ; in, and are the Laplace matrices of the t-1th time period and the tth time period respectively, and They are and The Network Laplacian Spectral Descriptor (NetLSD) consists of the traces of the heat kernel matrix at different times, and the heat kernel matrix is ​​obtained by exponentially transforming the Laplacian features; d t For the associated community distance; Represents the 2-norm operation. This graph processing method can better reflect the global information of the graph over time.

[0049] S5: Determine the distance d between associated community pairs t Is it greater than the adaptive threshold U t If so, mark the community in the tth time period, i.e. An exception occurred; if not, it indicates the community in the tth time period is normal.

[0050] When the network is in a normal state, the difference between the corresponding communities in adjacent time periods is very small. This means that the distance d between the associated community pairs is t The lower the value, the closer the network state is to normal. When the network is attacked by an abnormality, the similarity between the abnormal and normal network graphs will decrease significantly, resulting in a sharp increase in the structural distance and the distance d between the associated community pairs. tThe increase in indicates that the possibility of attack behavior in the network increases. The network state essentially changes dynamically over time. The normal network state is not static, but will be updated with changes in various factors such as the network environment. Therefore, network communication is dynamic and volatile. Using a fixed threshold to detect abnormal network status may lead to a decrease in detection accuracy. The dynamic threshold will be dynamically adjusted according to the instant changes and volatility characteristics of the network state. It not only avoids the accuracy problems that may be caused by the static threshold, but also can be effectively adjusted based on the range of normal state fluctuations. Therefore, it is crucial to define the network threshold in combination with the dynamic changes of the network structure. We apply sliding window technology and adaptive threshold methods to detect whether the network is under attack.

[0051] Adaptive threshold U t The steps to obtain include: SS1: Based on the distance d between the associated community pairs in the t-2th time period and the t-1th time period t-1 , get the distance prediction value of the associated community pair between the t-1th time period and the tth time period , the calculation formula is: ; Where α is the smoothing coefficient and 0<α<1, is the predicted distance value of the associated community pair between the t-2th time period and the t-1th time period.

[0052] SS2: Based on the distance of the associated community pairs, the distance mean avg and distance standard deviation V of the associated community pairs in the sliding window are calculated. The calculation formulas are: ; Among them, k is the size of the sliding window, t is the time period number, and d x is the distance between the associated community pairs in the x-1th time period and the xth time period, x=t-k+1,...,t.

[0053] SS3: Distance prediction based on associated community pairs And the distance standard deviation V of the associated community pairs in the sliding window, obtain the adaptive threshold U t , the calculation formula is: .

[0054] Among them, β is the standard deviation coefficient.

[0055] Compared with fixed thresholds that may ignore the dynamics of network traffic and cause false alarms or missed alarms, adaptive thresholds are dynamically adjusted according to the normal fluctuation range of current network traffic, ensuring the rationality and real-time nature of threshold settings, and effectively improving the accuracy and reliability of anomaly detection.

[0056] At the same time, the present invention adopts an exponentially weighted moving average model and sliding window technology, which can accurately capture the dynamic changes of network status and improve the detection accuracy. By accurately setting the dynamic threshold, the misjudgment rate is further reduced.

[0057] In this embodiment, the network status data of Vast challenge 2013 is selected as the experimental data set, with a data volume of about 5GB. The hardware experimental environment is: the processor is Intel(R) Core(TM) i7-12700K CPU @ 3.6GHz. The graphics card is NVIDIA GeForce GTX 1660 GPU. The software environment is Python 3.8.

[0058] In this embodiment, the sliding window is set to k=5, and the standard deviation coefficient is set to β=1.5. First, the community discovery algorithm in the present invention is used to perform community division and community matching on the above data set. After finding the community numbered 1, the anomaly detection accuracy of community 1 is tested under different sliding window k and standard deviation coefficient β values. The sliding window size can be set to a range of [5,20], increasing by 5 each time; the standard deviation coefficient can be set to a range of [0.5,2], increasing by 0.5 each time. According to sliding windows and standard deviation coefficients of different sizes, according to step S5 and the definition of anomaly detection accuracy, the anomaly detection accuracy results for community 1 can be obtained, as shown in the following table: Detection results of community 1 under different parameter settings ; It can be seen that for community 1, when the sliding window is set to k=5 and the standard deviation coefficient is set to β=1.5, the detection effect of community 1 is the best. Therefore, the sliding window is set to k=5 and the standard deviation coefficient is set to β=1.5. Then the four detection indicators (F1 score, recall rate, precision rate, accuracy rate) of all communities are calculated and compared with the NetLSD method, as shown in Figure 6 shown.

[0059] from Figure 6 It can be seen that the method of the present invention performs anomaly detection on the network status dataset of Vast challenge 2013. The community with the best detection effect and the average value of all community detection results are better than the detection results obtained by using the NetLSD method, and the effect comparison in terms of accuracy is significant.

[0060] Of course, it is obvious to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, but also includes the same or similar structures that can be implemented in other specific forms without departing from the spirit or essential features of the present invention. Therefore, no matter from which point of view, the embodiments should be regarded as exemplary and non-limiting, and the scope of the present invention is defined by the appended claims rather than the above description, and it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present invention. Any reference numerals in the claims should not be regarded as limiting the claims involved.

[0061] In addition, it should be understood that although the present specification is described according to implementation modes, not every implementation mode contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment may also be appropriately combined to form other implementation modes that can be understood by those skilled in the art.

[0062] The techniques, shapes, and structural parts not described in detail in the present invention are all well-known techniques.

Claims

1. A method for detecting abnormal network communities in dynamic graphs, characterized in that: include: S1: Obtain network communication flow data for each time period, draw a network communication flow graph for each time period, and construct a network dynamic graph model, wherein the network dynamic graph model is composed of network communication flow graphs arranged in order of time periods; S2, divide the nodes in the network communication flow graph in each time period to obtain the community set; S3, performing community matching based on the network communication flow graph of adjacent time periods to obtain associated community pairs between adjacent time periods; S4, calculate the distances of associated community pairs; S5: Determine whether the distance between the associated community pairs is greater than the adaptive threshold; Yes, indicating that an abnormality occurs in the community in the latter time period of the associated community pair; No, indicating that the community in the associated community pair is normal.

2. The abnormal network community detection method for dynamic graphs according to claim 1, characterized in that: In step S2, the nodes in the network communication flow graph of each time period are divided to obtain a community set, including: S21: Segment each network communication flow graph to obtain a number of segmented communities; S22: split and merge the divided communities multiple times to explore all possible ways of dividing the communities; S23: Calculate the modularity density for each partitioning method, find the partitioning method with the maximum modularity density, and mark the non-overlapping communities formed by the partitioning method with the maximum modularity density as the optimal non-overlapping communities, thereby forming a community set. , where C t is the community set formed in the tth time period, represents the qth community in the tth time period, and m is the total number of communities.

3. The abnormal network community detection method for dynamic graphs according to claim 2, characterized in that: The calculation process of the modularity density includes: C1: For each division method, the modularity Q is obtained based on multiple communities. The calculation formula of modularity Q is: ； Among them, C is the community set, c i is the ith community in C, is the number of edges between nodes in the ith community, is the number of edges from nodes in the ith community to nodes outside the ith community, |E| is the total number of edges in the network communication flow graph; C2: Calculate the segmentation penalty SP based on multiple communities. The calculation formula of the segmentation penalty SP is: ； in, represents the number of edges connecting the i-th community and the j-th community; C3: Obtain modularity density Q based on modularity and segmentation penalty ds , modularity density Q ds The calculation formula is: ； in, is the density within the i-th community; is the density between the i-th community and the j-th community.

4. The abnormal network community detection method for dynamic graphs according to claim 1, characterized in that: In step S3, performing community matching based on the network communication flow graph of adjacent time periods to obtain associated community pairs between adjacent time periods includes: S31: Two communities based on adjacent time periods , , calculate the similarity J between two communities pq , the formula is: ； in, For the community and community The number of overlapping nodes, For the community With the community The sum of the number of nodes; is the pth community in the t-1th time period, is the qth community in the tth time period; S32: Compare the similarity between the two communities with a set threshold, obtain several communities in the t-th time period corresponding to the p-th community in the t-1-th time period that exceed the set threshold, and mark them as communities to be selected; S33: Find the community with the highest similarity with the pth community in the t-1th time period among the communities to be selected, and use it as the community associated with the pth community in the t-1th time period, so as to obtain the associated community pairs between adjacent time periods. .

5. The abnormal network community detection method for dynamic graphs according to claim 1, characterized in that: In step S4, the distance between the associated community pairs is calculated, including: S41: Associated communities based on all matches , get the Laplace matrix and ; S42: Laplacian Matrix and Perform feature extraction to obtain the NetLSD vector and ; S43: Based on NetLSD vector and Get the distance d between the associated community pairs t ; in, is the pth community in the t-1th time period, is the qth community in the tth time period; and are the Laplace matrices of the t-1th time period and the tth time period respectively; and They are and The network Laplace spectrum describes the vector; d t For the associated community distance.

6. The abnormal network community detection method for dynamic graphs according to claim 1, characterized in that: In step S5, the step of obtaining the adaptive threshold comprises: SS1: Based on the distance d between the associated community pairs in the t-2th time period and the t-1th time period t-1 , get the distance prediction value of the associated community pair between the t-1th time period and the tth time period , the calculation formula is: ； Where α is the smoothing coefficient and 0<α<1, is the predicted distance value of the associated community pair between the t-2th time period and the t-1th time period; SS2: Calculate the distance mean avg and distance standard deviation V of the associated community pairs in the sliding window. The calculation formulas are: ； Among them, k is the size of the sliding window, t is the time period number, and d x is the distance between the associated community pairs in the x-1th time period and the xth time period, x=t-k+1,...,t; SS3: Distance prediction based on associated community pairs And the distance standard deviation V of the associated community pairs in the sliding window, obtain the adaptive threshold U t , the calculation formula is: ; Among them, β is the standard deviation coefficient.

7. The abnormal network community detection method for dynamic graphs according to claim 3, characterized in that: Said and The calculation formulas are: ； Among them, |c i | is the number of nodes in the i-th community.

8. The abnormal network community detection method for dynamic graphs according to claim 1, characterized in that: In step S1, the network is divided into multiple time periods according to fixed time intervals. In each time period, the IP of each host in the network communication is abstracted as a node, and the network communication between nodes is abstracted as an edge, thereby forming a network communication flow graph.

9. The abnormal network community detection method for dynamic graphs according to claim 2, characterized in that: In step S21, the network communication flow graph of each time period is segmented to obtain a plurality of segmented communities, each of which contains at least one node.

10. The abnormal network community detection method for dynamic graphs according to claim 5, characterized in that: The distance d between the associated community pairs t The calculation formula is: ； in, Represents the 2-norm operation.

Images