Traffic interaction diagram construction method and system for network traffic intrusion detection

Abstract

The invention discloses a traffic interaction diagram construction method and system for network traffic intrusion detection. The method comprises the following steps: preprocessing original network traffic data and extracting a traffic feature and a packet length sequence feature; performing normalization processing on the stream features and the packet length sequence features to obtain normalized stream features and packet length sequence features; a flow interaction topological graph is constructed according to normalized flow features and packet length sequence features, nodes in the flow interaction topological graph represent quintuple information (a source IP address, a destination IP address, a source port, a destination port and a protocol) of network flow, and edges represent interaction relations among different flows. The edge weight is assigned based on a time difference value or a data packet length list. The network flow behavior and content in the smart power grid can be captured and described more accurately, and intrusion detection can be performed more accurately.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to network traffic intrusion detection based on graph neural networks, and specifically to a traffic interaction graph construction method and system for network traffic intrusion detection. Background Art

[0002] Existing network intrusion detection technologies usually rely on the analysis of flow-level or packet-level features. These features include the source IP address, destination IP address, port number, protocol type, etc. of the traffic. Although they can capture certain network communication behaviors, these methods often only consider the characteristics of a single flow and ignore the potential interaction between different flows. Therefore, existing intrusion detection methods based on flow-level or packet-level features have shown certain limitations when dealing with complex and dynamic network attack scenarios. These methods are difficult to effectively identify complex attack behaviors involving multiple network nodes and multiple traffic interactions, such as distributed denial of service attacks (DDoS) and advanced persistent threats (APT).

[0003] In order to solve the above problems, in recent years, deep learning methods based on graph structures have gradually attracted the attention of researchers. By representing network traffic as a graph structure, the nodes in the graph represent the traffic, and the edges represent the interactive relationship between the traffic. This method can effectively capture the complex interactive characteristics and global relationships between the traffic. The development of graph neural network technologies such as graph convolutional networks (GCN) and graph attention networks (GAT) has enabled graph-based network intrusion detection methods to have stronger learning and expression capabilities, and to be able to process large-scale complex network traffic data. Summary of the invention

[0004] Purpose of the invention: In order to overcome the deficiencies in the prior art, the present invention provides a method for constructing a traffic interaction graph for network traffic intrusion detection, which prepares for the subsequent efficient traffic analysis through node construction and edge construction rules.

[0005] Technical solution: To achieve the above purpose, the technical solution adopted by the present invention is:

[0006] A method for constructing a traffic interaction graph for network traffic intrusion detection includes the following steps:

[0007] Step S1, preprocessing the original network traffic data and extracting flow features and packet length sequence features.

[0008] Step S2, normalizing the flow features and packet length sequence features to obtain normalized flow features and packet length sequence features.

[0009] Step S3, construct a traffic interaction topology map based on the normalized flow characteristics and packet length sequence characteristics, in which the nodes represent the five-tuple information of the network traffic (source IP address, destination IP address, source port, destination port, protocol), the edges represent the interaction relationship between different traffic flows, and the edge weights are assigned based on the time difference or the data packet length list. An adjacency matrix is ​​constructed based on the traffic interaction topology map, and the elements of the adjacency matrix determine whether there is an edge by calculating the time interval between the traffic flows and whether the source IP address and the destination IP address match. A node feature matrix is ​​constructed based on the five-tuple information of the traffic, and an edge feature matrix is ​​constructed based on the packet-level interaction features of the two flows.

[0010] Preferably: the method of step S1 comprises the following steps:

[0011] Step S11, perform traffic analysis on the original network traffic data to extract basic information of each packet, the basic information including timestamp, source IP address, destination IP address, source port, destination port, and protocol type.

[0012] Step S12, grouping the data packets according to the five-tuple (source IP address, destination IP address, source port, destination port, protocol) to form various network flows.

[0013] Step S13, for each network flow, extract the lengths of the first N data packets to obtain packet length sequence features, wherein if the number of data packets in a flow is less than N, data padding is performed.

[0014] Step S14, flow-level features are calculated from each constructed network flow to obtain flow features. The flow-level features include the total number of bytes and packets, the average packet size, the duration of the flow, and the transmission rate.

[0015] Preferred: Node construction method in step S3: Define each group of bidirectional flows as a node based on normalized flow characteristics and packet length sequence characteristics, and the node is identified by the five-tuple information of the network traffic, and the five-tuple includes source IP address, destination IP address, source port, destination port and protocol type.

[0016] Preferably, the construction of the edge in step S3 follows the following rules: a valid edge is established only when the time interval between the start of two flows is less than a preset threshold T. When the flows of two nodes have the same source IP address, a bidirectional edge is constructed. When the destination IP address of one flow is the source IP address of another flow, a unidirectional edge from the source IP to the destination IP is constructed.

[0017] Preferably, the edge construction method in step S3 comprises the following steps:

[0018] Step S301, setting a threshold T.

[0019] Step S3011, first read all node data, each node contains the following four key information: source IP address, destination IP address, timestamp, and data packet length list.

[0020] Step S3012, traverse each pair of nodes.

[0021] Step S3013: For each pair of nodes, first calculate the timestamp difference Δt between the two nodes:

[0022] Δt=nodes[j][Timestamp]-nodes[i][Timestamp]

[0023] If Δt is greater than the set threshold T, it is considered that there is no association between the two nodes and the pair of nodes is skipped. If Δt is less than or equal to T seconds, proceed to the next step of judgment.

[0024] Step S302: determine the edge relationship between two nodes according to the following two rules.

[0025] Step S3021, bidirectional edge: If the source IP addresses of the two nodes are the same, a bidirectional edge is generated, that is, there is bidirectional communication between node i and node j. The edge is written into the edges.csv file twice, once as the edge from i to j, and once as the edge from j to i.

[0026] Step S3022, unidirectional edge: If the destination IP address of node i is equal to the source IP address of node j, a unidirectional edge is generated from node i to node j. This edge indicates that node i has sent traffic to node j, and this edge is written to the edges.csv file.

[0027] Step S303: For each pair of nodes that meet the conditions, the calculated timestamp difference Δt, the length of the concatenated data packet pkt_len, and the numbers of the source node and the target node are recorded in the edges.csv file. Each row of data contains the following four fields: source node number, target node number, time difference Δt between nodes, and concatenated data packet length list.

[0028] Step S304, performing the above judgment and operation on each pair of nodes until all pairs of nodes are traversed and a complete adjacency matrix is ​​generated.

[0029] Preferred: The node features are the flow feature vectors of network traffic, including flow duration, number of packets, packet direction, and flow start time. The edge features are based on the properties of traffic interaction, including the time interval features of traffic, the direction features of traffic, and packet-level interaction features. The packet-level interaction features capture the interaction behavior between flows by concatenating the length sequences of the first several packets of two flows.

[0030] Preferably: it also includes a method for performing visualization operations according to the traffic interaction topology diagram:

[0031] Step S401, constructing a graph data structure: using the networkx library to read edge data from the edges.csv file and constructing a graph structure. Each node represents a node in the network flow, the edge represents the traffic interaction between nodes, and the edge weight is assigned based on the time difference or the packet length list.

[0032] Step S402, visualize nodes and edges: Use the matplotlib library to visualize the constructed graph, differentiate nodes by color or size according to traffic characteristics, and the thickness of the edge indicates the frequency of communication or the amount of data packet transmission.

[0033] Step S403, highlighting key nodes and edges: by calculating the network indicators of the nodes, identifying the key nodes and important edges in the graph, and highlighting the key nodes and important edges in the visualization graph with different colors or shapes, so as to more clearly analyze the important roles in the network.

[0034] Step S404: Visualize dynamic changes. Use the Plotly interactive visualization tool to display the dynamic changes of network flows. Display the changing process of data transmission between nodes over time. Use the slider or play button to view the evolution of traffic interactions over time.

[0035] Step S405, saving the visualization result: saving the generated static image or dynamic visualization result in PNG, SVG or HTML format to facilitate subsequent display and analysis.

[0036] Preferably: flow characteristics include source IP address, destination IP address, source port, destination port, protocol type, flow direction, duration, total number of data packets and size of data packets.

[0037] Another object of the present invention is to provide a traffic interaction graph construction system for network traffic intrusion detection, comprising a preprocessing feature extraction unit, a normalization unit, and a traffic interaction topology graph construction unit, wherein:

[0038] The preprocessing feature extraction unit is used to preprocess the original network flow data and extract flow features and packet length sequence features.

[0039] The normalization unit is used to perform normalization processing on the flow characteristics and the packet length sequence characteristics to obtain normalized flow characteristics and packet length sequence characteristics.

[0040] The traffic interaction topology map construction unit is used to construct a traffic interaction topology map based on the normalized flow characteristics and packet length sequence characteristics. The nodes in the traffic interaction topology map represent the five-tuple information of the network traffic (source IP address, destination IP address, source port, destination port, protocol), and the edges represent the interaction relationship between different traffic flows. The edge weight is assigned based on the time difference or the data packet length list. An adjacency matrix is ​​constructed based on the traffic interaction topology map. The elements of the adjacency matrix determine whether there is an edge by calculating the time interval between the traffic flows and whether the source IP address and the destination IP address match. A node feature matrix is ​​constructed based on the five-tuple information of the traffic, and an edge feature matrix is ​​constructed based on the packet-level interaction characteristics of the two flows.

[0041] Another object of the present invention is to provide an electronic device, comprising: at least one processor, at least one memory and a communication interface. The processor, memory and communication interface communicate with each other. The memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the traffic interaction graph construction method for network traffic intrusion detection according to any one of claims 1 to 8.

[0042] Compared with the prior art, the present invention has the following beneficial effects:

[0043] The design combining flow features with packet length sequence features can more accurately capture and describe the network traffic behavior and content in smart grids, which helps to detect intrusions more accurately. The node construction method can effectively capture the interactive relationship between different traffic in smart grids, provide rich input features for subsequent graph convolutional network (GCN) and graph attention network (GAT) models, and thus improve the accuracy of intrusion detection. The construction method can effectively capture the temporal relationship and interactive characteristics between different traffic in the network, and provide a more representative graph structure for subsequent intrusion detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is the overall flow chart of traffic interaction diagram construction.

[0045] Figure 2 This is an example diagram of traffic interaction. DETAILED DESCRIPTION

[0046] The present invention is further explained below in conjunction with the accompanying drawings and specific embodiments. It should be understood that these examples are only used to illustrate the present invention and are not used to limit the scope of the present invention. After reading the present invention, various equivalent forms of modifications to the present invention by those skilled in the art all fall within the scope defined by the claims attached to this application.

[0047] A method for constructing traffic interaction graph for network traffic intrusion detection, such as Figure 1 As shown, the following steps are included:

[0048] Step S1, preprocessing the original network traffic data and extracting flow features and packet length sequence features.

[0049] Step S11, perform traffic analysis on the original network traffic data to extract basic information of each packet, the basic information including timestamp, source IP address, destination IP address, source port, destination port, and protocol type.

[0050] In another embodiment, go to a specific website to collect raw network traffic data and download a data set. The data set is provided in PCAP format and contains multiple types of traffic features and labels for training and evaluating network traffic analysis models. The files are stored in corresponding folders.

[0051] In another embodiment, the walkFile function is used to traverse the directory where the PCAP file is located to collect all the traffic file paths. The function recursively traverses the folder and returns a list containing all the PCAP file paths to ensure that all PCAP files can be processed and analyzed one by one.

[0052] In another embodiment, traffic parsing is performed to extract basic information of each packet, such as timestamp, source IP, destination IP, source port, destination port, and protocol type.

[0053] Step S12, grouping the data packets according to the five-tuple (source IP address, destination IP address, source port, destination port, protocol) to form various network flows.

[0054] Step S13: For each network flow, extract the length of the first N data packets to obtain the packet length sequence feature. If the number of data packets in a flow is less than N, data padding is performed. Packet length sequence feature: In order to capture the characteristics of the first few data exchanges in the flow, for each network flow, extract the length of the first 20 data packets. If the number of data packets in a flow is less than 20, fill it with 0 to a length of 20 to ensure the consistency and comparability of all flow feature dimensions.

[0055] In another embodiment, for each network flow, the lengths of the first 20 packets are extracted. This is to capture the characteristics of the first few data exchanges in the flow. If the number of packets in a flow is less than 20, the length is padded to 20 with 0 to ensure the consistency and comparability of all flow feature dimensions.

[0056] Step S14, flow-level features are calculated from each constructed network flow to obtain flow features. Flow-level features include five-tuple information based on traffic (source IP address, destination IP address, source port, destination port, protocol type) as well as the total number of bytes and packets, average packet size, flow duration, and transmission rate, which are used to characterize the basic behavior and characteristics of network traffic.

[0057] Step S15, feature merging. After parsing all the data packets in the PCAP file, merge the extracted traffic features with the packet length sequence features. Use the merge function to connect the packet length sequence features and the flow level features with the unique identifier of the flow as the primary key. Save the extracted traffic features as CSV or other formats for subsequent intrusion detection or traffic analysis.

[0058] Step S16, exception handling. For various abnormal situations in PCAP files, such as IPv6 data packet parsing failure, data packet damage, etc., the present invention provides a detailed error handling mechanism. By capturing dpkt.UnpackError and dpkt.NeedData exceptions, the present invention can skip damaged data packets and continue to process valid data. At the same time, the present invention records all PCAP files with problems in the error list for subsequent analysis and repair.

[0059] The present invention downloads raw network traffic data in PCAP format from a specific website and stores it in a specified directory. Then, by traversing these file paths and parsing each data packet to extract basic information (such as timestamp, IP address, port and protocol type), a network flow is constructed. Packet length sequence and other flow-level features, such as total number of bytes and transmission rate, are extracted for each flow. Finally, all features are merged and stored in CSV format. These data lay the foundation for subsequent traffic analysis.

[0060] Step S2, normalizing the flow features and packet length sequence features to obtain normalized flow features and packet length sequence features.

[0061] Step S201: Read feature data from the previously generated CSV files, use pandas to read each CSV file, and add corresponding traffic labels (such as Function and Application).

[0062] Step S202: sort the traffic data in ascending order according to the timestamp, and convert the timestamp into a standard Unix timestamp for subsequent traffic interaction relationship analysis.

[0063] Step S203: Use MinMaxScaler to normalize the multi-dimensional features, including flow duration, total number of packets, packet length, flow rate, maximum and minimum values ​​of packets, etc. These normalized features are helpful for model training and graph construction.

[0064] Step S204: merge multiple traffic feature files into one data set, classify the data according to specific labels, and downsample the large categories to ensure that the number of samples in each category is balanced. The traffic feature data finally generated is stored as a nodes.csv file.

[0065] Step S3, construct a traffic interaction topology map based on the normalized flow characteristics and packet length sequence characteristics, in which the nodes represent the five-tuple information of the network traffic (source IP address, destination IP address, source port, destination port, protocol), the edges represent the interaction relationship between different traffic flows, and the edge weights are assigned based on the time difference or the data packet length list. An adjacency matrix is ​​constructed based on the traffic interaction topology map, and the elements of the adjacency matrix determine whether there is an edge by calculating the time interval between the traffic flows and whether the source IP address and the destination IP address match. A node feature matrix is ​​constructed based on the five-tuple information of the traffic, and an edge feature matrix is ​​constructed based on the packet-level interaction features of the two flows.

[0066] The node features are the flow feature vectors of network traffic, including flow duration, number of packets, packet direction, and flow start time. The edge features are based on the properties of traffic interaction, including the time interval features of traffic, the direction features of traffic, and packet-level interaction features. The packet-level interaction features capture the interaction behavior between flows by concatenating the length sequences of the first several packets of two flows.

[0067] Node construction method: Each group of bidirectional flows is defined as a node based on the normalized flow characteristics and packet length sequence characteristics. The node is identified by the five-tuple information of the network traffic, which includes the source IP address, destination IP address, source port, destination port and protocol type. The node feature is the flow feature vector of the network traffic, including flow duration, number of packets, packet direction, flow start time, etc., which is used to comprehensively describe the bidirectional flow characteristics of each flow node.

[0068] The present invention reads feature data from the CSV file generated in the previous step and processes it. First, it is sorted by timestamp and converted to Unix format, and then multi-dimensional features including flow duration, number of packets, etc. are normalized. Next, multiple feature files are merged into a data set, and the data is classified and downsampled to ensure the balance of the sample, and finally a data file of node features is generated.

[0069] In the traffic interaction topology diagram, the edges between nodes are directed edges, and the construction of edges follows the following rules: a valid edge is established only when the time interval between the start of two flows is less than the preset threshold T. When the flows of two nodes have the same source IP address, a bidirectional edge is constructed. When the destination IP address of one flow is the source IP address of another flow, a unidirectional edge from the source IP to the destination IP is constructed.

[0070] The characteristics of the edge are based on the properties of traffic interaction, including: the time interval characteristics of the traffic, that is, the time difference between two flows; the direction characteristics of the traffic, indicating the direction of the traffic from one node to another; the packet-level interaction characteristics, which captures the interaction behavior between flows by splicing the length sequences of the first several data packets of the two flows.

[0071] Edge construction method: The present invention traverses the node pairs according to the set time difference threshold to determine whether an edge relationship is formed. According to the time difference between the two nodes and the IP address information, the relationship between the nodes is divided into a bidirectional edge, a unidirectional edge or no edge. For node pairs that meet the conditions, their time difference and data packet length information are recorded to generate an edge data file describing the network interaction and complete the network adjacency information. Specifically, the following steps are included:

[0072] Step S301, setting a threshold T.

[0073] Step S3011, first read all node data from the generated nodes.csv file. Each node contains the following four key information: source IP address, destination IP address, processed UNIX timestamp, and data packet length list.

[0074] Step S3012, traverse each pair of nodes, set two nested loops, the outer loop i starts from the first node, and the inner loop j starts from the next node i+1, ensuring that each pair of nodes is traversed only once.

[0075] Step S3013: For each pair of nodes, first calculate the timestamp difference Δt between the two nodes:

[0076] Δt=nodes[j][Timestamp]-nodes[i][Timestamp]

[0077] If Δt is greater than the set threshold T, it is considered that there is no association between the two nodes and the pair of nodes is skipped. If Δt is less than or equal to T seconds, proceed to the next step of judgment.

[0078] Step S302: determine the edge relationship between two nodes according to the following two rules.

[0079] Step S3021, bidirectional edge: If the source IP addresses of the two nodes are the same, a bidirectional edge is generated, that is, there is bidirectional communication between node i and node j. The edge is written into the edges.csv file twice, once as the edge from i to j, and once as the edge from j to i.

[0080] Step S3022, unidirectional edge: If the destination IP (Dst IP) of node i is equal to the source IP (Src IP) of node j, the present invention generates a unidirectional edge from node i to node j. This edge indicates that node i has sent traffic to node j, and the present invention writes this edge into the edges.csv file.

[0081] Step S303: For each pair of nodes that meet the conditions, the calculated timestamp difference Δt, the length of the concatenated data packet pkt_len, and the numbers of the source node and the target node are recorded in the edges.csv file. Each row of data contains the following four fields: source node number, target node number, time difference Δt between nodes, and concatenated data packet length list.

[0082] Step S304, performing the above judgment and operation on each pair of nodes until all pairs of nodes are traversed and a complete adjacency matrix is ​​generated.

[0083] Step 4: Perform subsequent visualization operations

[0084] Step S401, constructing a graph data structure: Use the networkx library to read edge data from the edges.csv file and construct a graph structure. Each node represents a node in the network flow, and the edge represents the traffic interaction between nodes. The edge weight can be assigned based on the time difference or the packet length list.

[0085] Step S402, visualize nodes and edges: Use the matplotlib library to visualize the constructed graph. Nodes can be distinguished by color or size according to traffic characteristics. For example, the size of a node can represent the total number of bytes of traffic at the node, and the color can represent the average length of a data packet. The thickness of an edge can represent the frequency of communication or the amount of data packet transmission.

[0086] Step S403, highlight key nodes and edges: by calculating network indicators such as degree centrality and betweenness centrality of nodes, identify key nodes and important edges in the graph, and highlight these nodes or edges in different colors or shapes in the visualization graph, so as to more clearly analyze the important roles in the network.

[0087] Step S404: Visualize dynamic changes. Use interactive visualization tools such as Plotly to display dynamic changes in network flows. For example, display the changing process of data transmission between nodes over time. Through the slider or play button, users can view the evolution of traffic interactions over time.

[0088] Step S405, saving the generated static image or dynamic visualization result in PNG, SVG or HTML format to facilitate subsequent display and analysis.

[0089] In the last step, based on the complete node and edge data files constructed in the previous steps, the present invention supports visual analysis of network traffic. This visualization enables network analysts to intuitively display and understand complex network interactions in a graphical manner, improve analysis efficiency and assist decision making.

[0090] In another embodiment, a traffic interaction graph construction system for network traffic intrusion detection is provided, including a preprocessing feature extraction unit, a normalization unit, and a traffic interaction topology graph construction unit, wherein:

[0091] The preprocessing feature extraction unit is used to preprocess the original network flow data and extract flow features and packet length sequence features.

[0092] The normalization unit is used to perform normalization processing on the flow characteristics and the packet length sequence characteristics to obtain normalized flow characteristics and packet length sequence characteristics.

[0093] The traffic interaction topology map construction unit is used to construct a traffic interaction topology map based on the normalized flow characteristics and packet length sequence characteristics. The nodes in the traffic interaction topology map represent the five-tuple information of the network traffic (source IP address, destination IP address, source port, destination port, protocol), and the edges represent the interaction relationship between different traffic flows. The edge weight is assigned based on the time difference or the data packet length list. An adjacency matrix is ​​constructed based on the traffic interaction topology map. The elements of the adjacency matrix determine whether there is an edge by calculating the time interval between the traffic flows and whether the source IP address and the destination IP address match. A node feature matrix is ​​constructed based on the five-tuple information of the traffic, and an edge feature matrix is ​​constructed based on the packet-level interaction characteristics of the two flows.

[0094] In another embodiment, an electronic device is provided, comprising: at least one processor, at least one memory and a communication interface. The processor, the memory and the communication interface communicate with each other. The memory stores program instructions executable by the processor, and the processor calls the program instructions to execute the traffic interaction graph construction method for network traffic intrusion detection according to any one of claims 1 to 8.

[0095] The present invention can be used for network traffic analysis, in particular, to extract features from PCAP files, construct a relationship graph of nodes and edges, and finally perform visual display. First, it collects and processes raw network traffic data from a data set in PCAP format, extracts basic information of each data packet, such as timestamp, IP address, port and protocol type. Next, it groups the data packets into flows according to the five-tuple, and extracts important traffic features, such as packet length sequence, total number of bytes, number of packets, etc. Then, the features are merged into a CSV file, and the present invention processes the data by normalization and labeling. Next, by calculating information such as the time difference between nodes, the present invention determines the edge relationship between nodes, such as two-way communication or one-way communication, and generates an adjacency matrix representing the network structure. In terms of visualization, the present invention uses tools to construct a graph structure, and distinguishes nodes and edges by color, size and weight according to different features. By highlighting key nodes and edges, the present invention helps users analyze important network roles, and finally generates static or dynamic visualization graphs for subsequent display and analysis. This invention helps to improve the efficiency of network traffic analysis, especially in security detection and abnormal traffic analysis.

[0096] The present invention can overcome the limitations of traditional methods, effectively improve detection accuracy and efficiency, and is suitable for large-scale complex network environments such as smart grids, with important research value and application prospects. Graph construction plays a vital role in graph neural network intrusion detection. It can accurately reflect the topological structure and traffic relationship of the network, and provide a solid foundation for subsequent feature extraction and attack identification. This method can not only capture the interaction between different traffic in the network through the feature representation of nodes and edges, but also realize the accurate identification of network attacks through deep learning models.

[0097] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for constructing a traffic interaction graph for network traffic intrusion detection, characterized in that: The following steps are involved: Step S1, preprocessing the original network traffic data and extracting flow features and packet length sequence features; Step S2, normalizing the flow features and the packet length sequence features to obtain normalized flow features and packet length sequence features; Step S3, constructing a traffic interaction topology graph based on the normalized flow characteristics and packet length sequence characteristics, in which the nodes represent the five-tuple information of the network traffic (source IP address, destination IP address, source port, destination port, protocol), the edges represent the interaction relationship between different traffic flows, and the edge weights are assigned based on the time difference or the data packet length list; An adjacency matrix is ​​constructed based on the traffic interaction topology graph. The elements of the adjacency matrix determine whether there is an edge by calculating the time interval between traffic flows and whether the source IP address and the destination IP address match; The node feature matrix is ​​constructed based on the five-tuple information of the traffic, and the edge feature matrix is ​​constructed based on the packet-level interaction features of the two flows.

2. The method for constructing a traffic interaction graph for network traffic intrusion detection according to claim 1 is characterized by: The method of step S1 comprises the following steps: Step S11, performing traffic analysis on the original network traffic data to extract basic information of each packet, the basic information including timestamp, source IP address, destination IP address, source port, destination port, and protocol type; Step S12, grouping the data packets according to the five-tuple (source IP address, destination IP address, source port, destination port, protocol) to form various network flows; Step S13, for each network flow, extract the lengths of the first N data packets to obtain a packet length sequence feature, wherein if the number of data packets in a flow is less than N, data padding is performed; Step S14, calculating the flow-level features from each constructed network flow to obtain the flow features; the flow-level features include the total number of bytes and packets, the average packet size, the duration of the flow, and the transmission rate.

3. The method for constructing a traffic interaction graph for network traffic intrusion detection according to claim 2 is characterized in that: Node construction method in step S3: define each group of bidirectional flows as a node according to the normalized flow characteristics and packet length sequence characteristics. The node is identified by the five-tuple information of the network traffic, and the five-tuple includes the source IP address, destination IP address, source port, destination port and protocol type.

4. The method for constructing a traffic interaction graph for network traffic intrusion detection according to claim 3 is characterized by: The construction of the edge in step S3 follows the following rules: a valid edge is established only when the start time interval of two flows is less than the preset threshold T; a bidirectional edge is constructed when the flows of two nodes have the same source IP address; when the destination IP address of one flow is the source IP address of another flow, a unidirectional edge from the source IP to the destination IP is constructed.

5. The method for constructing a traffic interaction graph for network traffic intrusion detection according to claim 4 is characterized in that: The edge construction method in step S3 includes the following steps: Step S301, setting a threshold T; Step S3011, first read all node data, each node contains the following four key information: source IP address, destination IP address, timestamp, data packet length list; Step S3012, traverse each pair of nodes; Step S3013: For each pair of nodes, first calculate the timestamp difference Δt between the two nodes: Δt=nodes[j][Timestamp]-nodes[i][Timestamp] If Δt is greater than the set threshold T, it is considered that there is no association between the two nodes and the pair of nodes is skipped; if Δt is less than or equal to T seconds, proceed to the next step of judgment; Step S302, determining the edge relationship between two nodes according to the following two rules; Step S3021, bidirectional edge: if the source IP addresses of the two nodes are the same, a bidirectional edge is generated, that is, there is bidirectional communication between node i and node j; the edge is written into the edges.csv file twice, once as the edge from i to j, and once as the edge from j to i; Step S3022, unidirectional edge: if the destination IP address of node i is equal to the source IP address of node j, a unidirectional edge from node i to node j is generated; this edge indicates that node i has sent traffic to node j, and this edge is written into the edges.csv file; Step S303: For each pair of nodes that meet the conditions, the calculated timestamp difference Δt, the length of the concatenated data packet pkt_len, and the numbers of the source node and the target node are recorded in the edges.csv file; each row of data contains the following four fields: source node number, target node number, time difference Δt between nodes, and a list of concatenated data packet lengths; Step S304, performing the above judgment and operation on each pair of nodes until all pairs of nodes are traversed and a complete adjacency matrix is ​​generated.

6. The method for constructing a traffic interaction graph for network traffic intrusion detection according to claim 5 is characterized in that: The characteristics of the nodes are the flow feature vectors of the network traffic, including flow duration, number of packets, packet direction, and flow start time; the characteristics of the edges are based on the properties of traffic interaction, including the time interval characteristics of the traffic, the direction characteristics of the traffic, and the packet-level interaction characteristics. The packet-level interaction characteristics refer to capturing the interaction behavior between flows by splicing the length sequences of the first several packets of two flows.

7. The method for constructing a traffic interaction graph for network traffic intrusion detection according to claim 6, characterized in that: It also includes methods for visualizing traffic interaction topology diagrams: Step S401, constructing a graph data structure: using the networkx library to read edge data from the edges.csv file and constructing a graph structure; each node represents a node in the network flow, the edge represents the traffic interaction between nodes, and the edge weight is assigned based on the time difference or the data packet length list; Step S402, visualize nodes and edges: use the matplotlib library to visualize the constructed graph, distinguish nodes by color or size according to traffic characteristics, and the thickness of the edge indicates the frequency of communication or the amount of data packet transmission; Step S403, highlighting key nodes and edges: by calculating the network index of the nodes, identifying the key nodes and important edges in the graph, and highlighting the key nodes and important edges in the visualization graph with different colors or shapes, so as to more clearly analyze the important roles in the network; Step S404, dynamic change visualization: Use Plotly interactive visualization tool to show the dynamic changes of network flow; show the change process of data transmission between nodes over time; use the slider or play button to view the evolution of traffic interaction over time; Step S405, saving the visualization result: saving the generated static image or dynamic visualization result in PNG, SVG or HTML format to facilitate subsequent display and analysis.

8. The method for constructing a traffic interaction graph for network traffic intrusion detection according to claim 7, characterized in that: Flow characteristics include source IP address, destination IP address, source port, destination port, protocol type, direction of traffic, duration, total number of packets, and size of packets.

9. A system based on the method for constructing a traffic interaction graph for network traffic intrusion detection according to claim 1, characterized in that: It includes a preprocessing feature extraction unit, a normalization unit, and a traffic interaction topology map construction unit, where: The preprocessing feature extraction unit is used to preprocess the original network flow data and extract flow features and packet length sequence features; The normalization unit is used to perform normalization processing on the flow characteristics and the packet length sequence characteristics to obtain normalized flow characteristics and packet length sequence characteristics; The traffic interaction topology map construction unit is used to construct a traffic interaction topology map according to normalized flow characteristics and packet length sequence characteristics, in which nodes represent five-tuple information of network traffic (source IP address, destination IP address, source port, destination port, protocol), edges represent the interaction relationship between different traffic flows, and edge weights are assigned based on time differences or data packet length lists; an adjacency matrix is ​​constructed based on the traffic interaction topology map, and the elements of the adjacency matrix determine whether there is an edge by calculating the time interval between the traffic flows and whether the source IP address and the destination IP address match; a node feature matrix is ​​constructed based on the five-tuple information of the traffic, and an edge feature matrix is ​​constructed based on the packet-level interaction characteristics of the two traffic flows.

10. An electronic device, characterized in that: include: at least one processor, at least one memory, and a communication interface; The processor, memory and communication interface communicate with each other; The memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the traffic interaction graph construction method for network traffic intrusion detection as described in any one of claims 1-8.

Images