Network traffic detection method and device, electronic equipment and storage medium

Abstract

The invention provides a network traffic detection method and device, electronic equipment and a storage medium. The method comprises the following steps: constructing an initial network traffic interaction diagram according to traffic data in a target network; for each node in the interaction graph, performing updating processing according to the initial node feature, the incoming node feature and the outgoing node feature of the node to obtain the comprehensive node feature of the node; for each edge in the interaction graph, determining a first aggregation feature of a first node corresponding to the edge and a second aggregation feature of a second node, and performing update processing by combining the initial edge feature of the edge, the initial node feature of the first node and the initial node feature of the second node to obtain a comprehensive edge feature of the edge; and inputting all the comprehensive node features and all the comprehensive edge features into an anomaly detection model, and determining a detection result. In this way, according to the scheme, the abnormal traffic existing in the network can be recognized more accurately by optimizing the graph feature representation mode.

Description

Technical Field

[0001] The present application relates to the field of network detection technology, and in particular to a method, device, electronic device and storage medium for detecting network traffic. Background Art

[0002] With the continuous development of network communication technology, high-frequency communication scenarios are becoming increasingly common in modern communication networks, especially in the fields of industrial control networks, the Internet of Things, and real-time data analysis. In such scenarios, the number of network devices is relatively small, but the data transmission between them is intensive and the communication frequency is very high. Attackers often use some attack methods to hide in them. The high-density communication information provides a natural barrier for attackers, which undoubtedly brings new challenges to abnormal network traffic detection.

[0003] As an important means to ensure network security and stable operation, anomaly detection mainly aims to identify abnormal patterns and behaviors in the network by analyzing traffic data. With the increase in the frequency and complexity of network communications, traditional abnormal traffic detection methods mainly include statistical methods and machine learning-based methods, such as support vector machines and random forests. These methods mainly focus on the statistical characteristics of traffic between devices. Although these methods have improved the detection accuracy to a certain extent, attackers can still take some measures to disguise themselves as normal traffic to bypass the anomaly detection model. When the time series characteristics in the traffic data and the topological structure characteristics of the network are fully utilized, the attackers need to spend a lot of money to change. In order to cope with the evolution of complex attack patterns and make full use of the time series and spatial topological information in the traffic data, graph-based anomaly detection methods have emerged.

[0004] Graph-based abnormal traffic detection methods can effectively handle large-scale networks and mine deep topological information. At present, graph-based abnormal traffic detection technology has a very broad application scenario, such as attack problems in financial networks, illegal intrusions, malicious traffic and other attacks in communication networks, and potential advanced sustainable threats in industrial control networks. These attacks will pose serious threats to users and society. Therefore, in the context of increasingly high-frequency data interactions and increasingly hidden attack methods, graph anomaly detection methods, as one of the key technologies in the field of data security and network security, contain rich scientific research value and practical significance.

[0005] However, the existing graph-based abnormal traffic detection model mainly relies on aggregated node features to mine network topology information. When faced with high-density traffic data, frequent interactions between nodes lead to a large number of multiple edges in the network, that is, multiple edges exist between the same pair of nodes in a short period of time. This makes the network structure extremely complex, which makes the trained graph model perform poorly in complex high-density communication scenarios and cannot accurately identify abnormal results. Summary of the invention

[0006] In view of this, the purpose of this application is to provide a network traffic detection method, device, electronic device and storage medium. By optimizing the graph feature representation method, abnormal traffic in the network can be more accurately identified, thereby providing stronger protection for subsequent network security decisions.

[0007] The present application provides a method for detecting network traffic, the method comprising:

[0008] According to the communication endpoint information and traffic interaction information in the collected traffic data in the target network, an initial network traffic interaction graph with edge-sensitive characteristics is constructed, and an initial node feature of each node and an initial edge feature of each edge in the initial network traffic interaction graph are determined;

[0009] For each node in the initial network traffic interaction graph, node feature update processing is performed according to the initial node feature of the node, the incoming node feature transmitted from each adjacent node to the node, and the outgoing node feature transmitted from the node to each adjacent node to obtain the comprehensive node feature of the node;

[0010] For each edge in the initial network traffic interaction graph, determine a first node and a second node corresponding to the edge, and determine a first aggregation feature of all incoming edges of the first node and a second aggregation feature of all incoming edges of the second node;

[0011] Perform edge feature update processing according to the initial edge feature of the edge, the initial node feature of the first node, the initial node feature of the second node, the first aggregate feature, and the second aggregate feature to obtain a comprehensive edge feature of the edge;

[0012] The comprehensive node features of all nodes and the comprehensive edge features of all edges are input into a pre-trained anomaly detection model to determine the detection result of the network traffic in the target network; wherein the anomaly detection model is obtained by training an edge-integrated graph attention network.

[0013] Optionally, constructing an initial network traffic interaction graph with edge-sensitive characteristics according to the communication endpoint information and traffic interaction information in the collected traffic data in the target network includes:

[0014] Collecting traffic data in the target network environment to obtain original network data packets;

[0015] Performing flow data processing on the original network data packet to determine the target network data flow;

[0016] Determine at least one node according to the communication endpoint information in the target network data flow, and determine at least one edge according to the traffic interaction information between the communication endpoints in the target network data flow;

[0017] The initial network traffic interaction graph is constructed based on all determined nodes and all edges.

[0018] Optionally, performing node feature update processing according to the initial node feature of the node, the incoming node feature transmitted from each adjacent node to the node, and the outgoing node feature transmitted from the node to each adjacent node to obtain the comprehensive node feature of the node includes:

[0019] Aggregate all incoming node features of the node to obtain the aggregated incoming features of the node;

[0020] Aggregate all outgoing node features of the node to obtain the aggregated outgoing features of the node;

[0021] According to the initial node feature of the node, the aggregated incoming feature of the node, and the aggregated incoming feature of the node, a node feature update process is performed to obtain a comprehensive node feature of the node.

[0022] Optionally, the step of inputting the comprehensive node features of all nodes and the comprehensive edge features of all edges into a pre-trained anomaly detection model to determine the detection result of the network traffic in the target network includes:

[0023] Based on the interaction relationship between nodes and edges, the comprehensive node features of each node and the comprehensive edge features of each edge are weighted updated respectively through the edge attention layer in the anomaly detection model to obtain the output node features of each node and the output edge features of each edge;

[0024] Classify the output node features of all nodes and the output edge features of all edges through the MLP layer in the anomaly detection model to obtain network category features;

[0025] The network category features are normalized by the softmax layer in the anomaly detection model, and the detection result of the network traffic in the target network is output.

[0026] Optionally, determine the output node characteristics of each node by following the steps below:

[0027] Perform linear transformation on the comprehensive node features of all nodes and the comprehensive node features of all edges to obtain the linear node features of each node and the linear edge features of each edge in the same dimension;

[0028] For each node, determine the node attention coefficient of any adjacent node relative to the node based on the linear node feature of the node, the linear node feature of any adjacent node corresponding to the node, and the linear edge feature of the connecting edge between the two nodes;

[0029] Performing normalization processing according to the node attention coefficients of all adjacent nodes relative to the node, determining the node normalized attention weight of any adjacent node relative to the node;

[0030] The output node feature of the node is obtained by performing weighted update processing according to the node normalized attention weights of all adjacent nodes relative to the node, the linear node features of the adjacent nodes, and the linear edge features of the edge where the node is located.

[0031] Optionally, determine the output edge characteristics of each edge by:

[0032] For each edge, determine the structural score of the edge based on the out-degree of the source node and the in-degree of the target node on the edge;

[0033] Determine an edge attention coefficient of the edge according to the structural score of the edge, the linear node feature of the source node on the edge, the linear node feature of the target node on the edge, and the linear edge feature of the edge;

[0034] Obtain the edge sensitivity of the edge, and perform normalization processing according to the edge sensitivity, the edge attention coefficient of the edge, and the edge attention coefficient of the edge where the target node is located, to determine the edge normalized attention weight of the edge;

[0035] A weighted update process is performed according to the edge normalized attention weight of the edge and the linear edge feature of the edge to obtain the output edge feature of the edge.

[0036] Optionally, determine the anomaly detection model by following these steps:

[0037] Acquire multiple sample network traffic interaction graphs in multiple experimental network environments, and determine the sample node features of the sample nodes and the sample edge features of the sample edges in each sample network traffic interaction graph; wherein each sample network traffic interaction graph is added with a real label;

[0038] Inputting the sample node features of all sample nodes and the sample edge features of all sample edges in the sample network traffic interaction graph into the edge integration graph attention network in turn to determine the prediction result of each sample network traffic interaction graph;

[0039] Determine at least one target loss function value according to the prediction result and the true label of each sample network traffic interaction graph;

[0040] The network parameters of the edge-integrated graph attention network are iteratively updated according to the at least one target loss function value and a preset learning rate strategy to obtain an anomaly detection model.

[0041] The present application also provides a network traffic detection device, the detection device comprising:

[0042] A construction module is used to construct an initial network traffic interaction graph with edge-sensitive characteristics based on the communication endpoint information and traffic interaction information in the collected traffic data in the target network, and determine the initial node characteristics of each node and the initial edge characteristics of each edge in the initial network traffic interaction graph;

[0043] A first updating module is used to perform node feature updating processing for each node in the initial network traffic interaction graph according to the initial node feature of the node, the incoming node feature transmitted from each adjacent node to the node, and the outgoing node feature transmitted from the node to each adjacent node, so as to obtain the comprehensive node feature of the node;

[0044] A determination module, configured to determine, for each edge in the initial network traffic interaction graph, a first node and a second node corresponding to the edge, and determine a first aggregation feature of all incoming edges of the first node and a second aggregation feature of all incoming edges of the second node;

[0045] A second updating module is used to perform edge feature updating processing according to the initial edge feature of the edge, the initial node feature of the first node, the initial node feature of the second node, the first aggregate feature, and the second aggregate feature to obtain a comprehensive edge feature of the edge;

[0046] A detection module is used to input the comprehensive node features of all nodes and the comprehensive edge features of all edges into a pre-trained anomaly detection model to determine the detection results of network traffic in the target network; wherein the anomaly detection model is obtained by training an edge-integrated graph attention network.

[0047] Optionally, when the construction module is used to construct an initial network traffic interaction graph with edge-sensitive characteristics according to the communication endpoint information and traffic interaction information in the collected traffic data in the target network, the construction module is used to:

[0048] Collecting traffic data in the target network environment to obtain original network data packets;

[0049] Performing flow data processing on the original network data packet to determine the target network data flow;

[0050] Determine at least one node according to the communication endpoint information in the target network data flow, and determine at least one edge according to the traffic interaction information between the communication endpoints in the target network data flow;

[0051] The initial network traffic interaction graph is constructed based on all determined nodes and all edges.

[0052] Optionally, when the first updating module is used to perform node feature update processing according to the initial node feature of the node, the incoming node feature transmitted from each adjacent node to the node, and the outgoing node feature transmitted from the node to each adjacent node to obtain the comprehensive node feature of the node, the first updating module is used to:

[0053] Aggregate all incoming node features of the node to obtain the aggregated incoming features of the node;

[0054] Aggregate all outgoing node features of the node to obtain the aggregated outgoing features of the node;

[0055] According to the initial node feature of the node, the aggregated incoming feature of the node, and the aggregated incoming feature of the node, a node feature update process is performed to obtain a comprehensive node feature of the node.

[0056] Optionally, when the detection module is used to input the comprehensive node features of all nodes and the comprehensive edge features of all edges into a pre-trained anomaly detection model to determine the detection result of the network traffic in the target network, the detection module is used to:

[0057] Based on the interaction relationship between nodes and edges, the comprehensive node features of each node and the comprehensive edge features of each edge are weighted updated respectively through the edge attention layer in the anomaly detection model to obtain the output node features of each node and the output edge features of each edge;

[0058] Classify the output node features of all nodes and the output edge features of all edges through the MLP layer in the anomaly detection model to obtain network category features;

[0059] The network category features are normalized by the softmax layer in the anomaly detection model, and the detection result of the network traffic in the target network is output.

[0060] Optionally, the detection module is further used to determine the output node feature of each node through the following steps:

[0061] Perform linear transformation on the comprehensive node features of all nodes and the comprehensive node features of all edges to obtain the linear node features of each node and the linear edge features of each edge in the same dimension;

[0062] For each node, determine the node attention coefficient of any adjacent node relative to the node based on the linear node feature of the node, the linear node feature of any adjacent node corresponding to the node, and the linear edge feature of the connecting edge between the two nodes;

[0063] Performing normalization processing according to the node attention coefficients of all adjacent nodes relative to the node, determining the node normalized attention weight of any adjacent node relative to the node;

[0064] The output node feature of the node is obtained by performing weighted update processing according to the node normalized attention weights of all adjacent nodes relative to the node, the linear node features of the adjacent nodes, and the linear edge features of the edge where the node is located.

[0065] Optionally, the detection module is further configured to determine the output edge feature of each edge by the following steps:

[0066] For each edge, determine the structural score of the edge based on the out-degree of the source node and the in-degree of the target node on the edge;

[0067] Determine an edge attention coefficient of the edge according to the structural score of the edge, the linear node feature of the source node on the edge, the linear node feature of the target node on the edge, and the linear edge feature of the edge;

[0068] Obtain the edge sensitivity of the edge, and perform normalization processing according to the edge sensitivity, the edge attention coefficient of the edge, and the edge attention coefficient of the edge where the target node is located, to determine the edge normalized attention weight of the edge;

[0069] A weighted update process is performed according to the edge normalized attention weight of the edge and the linear edge feature of the edge to obtain the output edge feature of the edge.

[0070] Optionally, the detection device further includes a training module, and the training module is used to determine the anomaly detection model through the following steps:

[0071] Acquire multiple sample network traffic interaction graphs in multiple experimental network environments, and determine the sample node features of the sample nodes and the sample edge features of the sample edges in each sample network traffic interaction graph; wherein each sample network traffic interaction graph is added with a real label;

[0072] Inputting the sample node features of all sample nodes and the sample edge features of all sample edges in the sample network traffic interaction graph into the edge integration graph attention network in turn to determine the prediction result of each sample network traffic interaction graph;

[0073] Determine at least one target loss function value according to the prediction result and the true label of each sample network traffic interaction graph;

[0074] The network parameters of the edge-integrated graph attention network are iteratively updated according to the at least one target loss function value and a preset learning rate strategy to obtain an anomaly detection model.

[0075] An embodiment of the present application also provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps of the detection method as described above are performed.

[0076] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the detection method described above are executed.

[0077] The embodiments of the present application provide a method, device, electronic device and storage medium for detecting network traffic. The detection method includes: constructing an initial network traffic interaction graph with edge-sensitive characteristics based on communication endpoint information and traffic interaction information in traffic data collected from a target network, and determining the initial node characteristics of each node and the initial edge characteristics of each edge in the initial network traffic interaction graph; for each node in the initial network traffic interaction graph, performing node characteristic update processing based on the initial node characteristics of the node, the incoming node characteristics transmitted from each adjacent node to the node, and the outgoing node characteristics transmitted from the node to each adjacent node to obtain a comprehensive node characteristic of the node; for the For each edge in the initial network traffic interaction graph, determine the first node and the second node corresponding to the edge, and determine the first aggregate feature of all incoming edges of the first node and the second aggregate feature of all incoming edges of the second node; perform edge feature update processing according to the initial edge feature of the edge, the initial node feature of the first node, the initial node feature of the second node, the first aggregate feature and the second aggregate feature to obtain the comprehensive edge feature of the edge; input the comprehensive node features of all nodes and the comprehensive edge features of all edges into a pre-trained anomaly detection model to determine the detection result of the network traffic in the target network; wherein the anomaly detection model is obtained by training the edge integrated graph attention network.

[0078] In this way, this application fully captures the complex traffic interaction relationships in the network by constructing the initial network traffic interaction graph based on the communication endpoint information and traffic interaction information, ensuring the integrity and accuracy of the graph structure. Moreover, the features of the nodes and edges in the graph not only contain their own information, but also integrate the interaction relationships with adjacent nodes or edges, which helps to reflect the fine-grained characteristics in network traffic. This solution uses an edge-integrated graph attention network for training and anomaly detection, which can dynamically adjust the feature aggregation strategy according to the edge weights, is more sensitive to capturing key traffic interaction relationships, and effectively improves the model's ability to recognize abnormal patterns.

[0079] In summary, this scheme can significantly improve the accuracy of network traffic anomaly detection by constructing an initial network traffic interaction graph with edge-sensitive characteristics, fine-tuning and updating the node and edge features in the graph, and introducing an edge-integrated graph attention network, thus providing strong technical support for anomaly detection in the target network.

[0080] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0081] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0082] Figure 1 A flowchart of a method for detecting network traffic provided by an embodiment of the present application;

[0083] Figure 2 A schematic diagram of the principle of determining the comprehensive node characteristics of a node provided by the present application;

[0084] Figure 3 A schematic diagram of the principle of determining the comprehensive edge features of an edge provided by the present application;

[0085] Figure 4 One of the structural schematic diagrams of a network traffic detection device provided in an embodiment of the present application;

[0086] Figure 5 A second structural diagram of a network traffic detection device provided in an embodiment of the present application;

[0087] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0088] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application usually described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, each other embodiment obtained by those skilled in the art without making creative work belongs to the scope of protection of the present application.

[0089] With the continuous development of network communication technology, high-frequency communication scenarios are becoming increasingly common in modern communication networks, especially in the fields of industrial control networks, the Internet of Things, and real-time data analysis. In such scenarios, the number of network devices is relatively small, but the data transmission between them is intensive and the communication frequency is very high. Attackers often use some attack methods to hide in them. The high-density communication information provides a natural barrier for attackers, which undoubtedly brings new challenges to abnormal network traffic detection.

[0090] As an important means to ensure network security and stable operation, anomaly detection mainly aims to identify abnormal patterns and behaviors in the network by analyzing traffic data. With the increase in the frequency and complexity of network communications, traditional abnormal traffic detection methods mainly include statistical methods and machine learning-based methods, such as support vector machines and random forests. These methods mainly focus on the statistical characteristics of traffic between devices. Although these methods have improved the detection accuracy to a certain extent, attackers can still take some measures to disguise themselves as normal traffic to bypass the anomaly detection model. When the time series characteristics in the traffic data and the topological structure characteristics of the network are fully utilized, the attackers need to spend a lot of money to change. In order to cope with the evolution of complex attack patterns and make full use of the time series and spatial topological information in the traffic data, graph-based anomaly detection methods have emerged.

[0091] Graph-based abnormal traffic detection methods can effectively handle large-scale networks and mine deep topological information. At present, graph-based abnormal traffic detection technology has a very broad application scenario, such as attack problems in financial networks, illegal intrusions, malicious traffic and other attacks in communication networks, and potential advanced sustainable threats in industrial control networks. These attacks will pose serious threats to users and society. Therefore, in the context of increasingly high-frequency data interactions and increasingly hidden attack methods, graph anomaly detection methods, as one of the key technologies in the field of data security and network security, contain rich scientific research value and practical significance.

[0092] However, the existing graph-based abnormal traffic detection model mainly relies on aggregated node features to mine network topology information. When faced with high-density traffic data, frequent interactions between nodes lead to a large number of multiple edges in the network, that is, multiple edges exist between the same pair of nodes in a short period of time. This makes the network structure extremely complex, which makes the trained graph model perform poorly in complex high-density communication scenarios and cannot accurately identify abnormal results.

[0093] Based on this, the embodiments of the present application provide a network traffic detection method, device, electronic device and storage medium. By optimizing the graph feature representation method, abnormal traffic in the network can be more accurately identified, thereby providing stronger protection for subsequent network security decisions.

[0094] See also Figure 1 , Figure 1 The following is a flow chart of a method for detecting network traffic provided by an embodiment of the present application. Figure 1 As shown in, the detection method provided in the embodiment of the present application includes:

[0095] S101. Construct an initial network traffic interaction graph with edge-sensitive characteristics based on the communication endpoint information and traffic interaction information in the collected traffic data in the target network, and determine the initial node characteristics of each node and the initial edge characteristics of each edge in the initial network traffic interaction graph.

[0096] S102. For each node in the initial network traffic interaction graph, node feature update processing is performed according to the initial node feature of the node, the incoming node feature transmitted from each adjacent node to the node, and the outgoing node feature transmitted from the node to each adjacent node to obtain the comprehensive node feature of the node.

[0097] S103. For each edge in the initial network traffic interaction graph, determine the first node and the second node corresponding to the edge, and determine the first aggregation feature of all incoming edges of the first node and the second aggregation feature of all incoming edges of the second node.

[0098] S104 , performing edge feature update processing according to the initial edge feature of the edge, the initial node feature of the first node, the initial node feature of the second node, the first aggregate feature, and the second aggregate feature to obtain a comprehensive edge feature of the edge.

[0099] S105: Input the comprehensive node features of all nodes and the comprehensive edge features of all edges into a pre-trained anomaly detection model to determine the detection result of the network traffic in the target network.

[0100] For step S101, when it is necessary to detect the traffic status in the target network, the traffic data at the current moment or the traffic data within a specified time period in the target network is collected according to a preset collection strategy; the collected traffic data is then analyzed to determine the communication endpoint information and traffic interaction information included therein; then, based on the included communication endpoint information and traffic interaction information, an initial network traffic interaction graph is constructed, and the initial node features of each node and the initial edge features of each edge in the initial network traffic interaction graph are determined.

[0101] Here, the initial network traffic interaction graph is an initial network traffic interaction graph with edge-sensitive characteristics, and the initial network traffic interaction graph is a directed multigraph. The initial network traffic interaction graph includes multiple nodes and multiple edges. One or more edges may be included between two nodes, and each node or edge is provided with a unique identity (e.g., an ID).

[0102] The target network refers to a network that needs to be monitored and analyzed, which may be an enterprise network, a data center network, a cloud platform, an industrial control network, etc.

[0103] The traffic data refers to the metadata of data packets transmitted through switches, routers and other devices in the network (such as source IP, destination IP, port number, protocol type, transmission delay, data packet size, data flow direction, TCP and UDP traffic, ARP protocol messages, timestamps, etc.).

[0104] Communication endpoint information may refer to the identification information of a device or host communicating in a network, usually including source IP address, destination IP address, port number, etc.

[0105] Traffic interaction information describes the interaction between different communication endpoints, and usually includes information such as the transmission direction, data volume, protocol type, and transmission delay of the data packet.

[0106] The initial network traffic interaction graph is a graph structure consisting of nodes and edges, where each node represents a communication endpoint and each edge represents the traffic interaction between two communication endpoints.

[0107] Edge-sensitive characteristics mean that the edges in the graph not only reflect the connection relationship between nodes, but also need to consider the characteristics of traffic interaction, such as data volume, interaction frequency, timeliness of traffic, etc. These characteristics will be used as edge features when constructing the graph.

[0108] Node characteristics are attribute information that describes each node, such as IP address, device type, total traffic volume, activity, etc.

[0109] Edge features: describe the interaction information between nodes, which may include the size of the data packet, transmission delay, interaction frequency, etc.

[0110] With respect to step S101, in one embodiment provided in the present application, constructing an initial network traffic interaction graph with edge-sensitive characteristics according to the communication endpoint information and traffic interaction information in the collected traffic data in the target network includes:

[0111] S1011. Collect traffic data in the target network environment to obtain original network data packets.

[0112] S1012: Perform stream data processing on the original network data packet to determine a target network data stream.

[0113] S1013. Determine at least one node based on the communication endpoint information in the target network data flow, and determine at least one edge based on the traffic interaction information between the communication endpoints in the target network data flow.

[0114] S1014: Construct the initial network traffic interaction graph based on all determined nodes and all edges.

[0115] With respect to step S1011, the flow data in the target network environment may be collected by means of a security monitoring device to obtain original network data packets.

[0116] Among them, security monitoring equipment is deployed at key locations of the network to ensure that the communication traffic between all major network nodes can be collected. These devices may include intrusion detection systems (IDS), traffic monitoring equipment, and network packet capture tools to ensure full coverage and capture of network data in high-frequency communication environments. Monitoring equipment should be able to collect traffic in real time and have efficient storage and processing capabilities to cope with the needs of collecting large amounts of traffic data.

[0117] The data in the original network data packets may include TCP and UDP traffic, ARP protocol messages, and their timestamps, source and destination MAC addresses, IP addresses, etc. This information can be captured in PCAP files and classified by timestamp and traffic direction to ensure that attack traffic can be restored and classified during the data analysis phase.

[0118] With respect to step S1012, a stream generator is used to parse and process the original network data packet (PCAP file), extract the data packet data into the required stream data, and obtain the target network data stream.

[0119] The target network data flow refers to a collection of continuous data packets transmitted between two communication endpoints in a network within a certain time window. These data packets have the same attributes such as source IP, destination IP, source port, and destination port, and are usually grouped by flow. A network flow can consist of multiple data packets, representing the communication between the source device and the destination device.

[0120] For step S1013, a communication endpoint refers to a device that sends or receives data packets in a network (such as a server, a router, a terminal device, etc.), and each communication endpoint is usually set with a unique identifier (IP address, or MAC address, or ID).

[0121] In the network traffic interaction graph, a node represents a communication endpoint, which can usually be determined by the communication endpoint information in the target network data flow. Each communication endpoint (such as an IP and port) corresponds to a node in the graph.

[0122] Traffic interaction information refers to the specific data transmission situation between two communication endpoints, such as data volume, transmission rate, latency, etc. For each pair of communication endpoints, there will be at least one edge, and the characteristics of the edge reflect the communication behavior between the two nodes.

[0123] For example, directed edges are distinguished according to the communication direction, and a network interaction heterogeneous graph containing three edge types is constructed, namely "IP-connect-IP", "MAC-connect-MAC", and "IP-belongs to-MAC". The first two represent the data flow transmission edges between communication nodes, and the latter only represents the subordinate relationship between IP and MAC.

[0124] For step S1014, all nodes (communication endpoints) and edges (traffic interactions between nodes) are combined to form a graph structure, that is, the initial network traffic interaction graph is determined. Each node represents a communication endpoint, and each edge represents the traffic interaction between two endpoints.

[0125] In addition, if the target network is detected in real time, the determined initial network traffic interaction graph can be determined by updating the previous network traffic interaction graph according to the current traffic data. For example, the current nodes and edges are determined according to the current traffic data, and then the determined nodes and edges are used to update the previous network traffic interaction graph to obtain the initial network traffic interaction graph at the current moment.

[0126] In this way, it can adapt to the changing network traffic patterns through real-time updates. In addition, the initial network traffic interaction graph can be sparsely processed based on the importance of the edges, which helps to reduce the computational complexity of the graph without affecting the detection performance.

[0127] With respect to step S102, the initial node characteristics may refer to original attribute information of each node, which may include the IP address of the node, communication behavior statistics, etc.

[0128] The incoming node characteristics refer to the characteristics of data transmitted from an adjacent node to the node (for example, the flow, delay, number of data packets from other nodes, etc.).

[0129] The outgoing node characteristics refer to the characteristics of data transmitted from the node to other adjacent nodes (for example, the traffic, delay, number of data packets sent by the node, etc.).

[0130] The node feature update process may be a process of comprehensively adjusting the initial features of the current node by combining adjacent incoming node features and outgoing features in a weighted manner.

[0131] The adjacent nodes of a node are determined by the following steps: determining each edge where the node is located; determining all nodes on all edges except the node as adjacent nodes of the node. Each node has at least one adjacent node.

[0132] For example, with respect to step S102, in one embodiment provided in the present application, performing node feature update processing according to the initial node feature of the node, the incoming node feature transmitted from each adjacent node to the node, and the outgoing node feature transmitted from the node to each adjacent node to obtain the comprehensive node feature of the node includes:

[0133] S1021. Aggregate all incoming node features of the node to obtain aggregated incoming features of the node.

[0134] S1022: Aggregate all outgoing node features of the node to obtain aggregated outgoing features of the node.

[0135] S1023. Perform node feature update processing according to the initial node feature of the node, the aggregated incoming feature of the node, and the aggregated incoming feature of the node to obtain the comprehensive node feature of the node.

[0136] With respect to step S1021, the goal of this step is to aggregate the traffic features transmitted to the node by all the neighboring nodes of the node, thereby obtaining the aggregated incoming features of the node.

[0137] The aggregation methods used may include weighted average, sum aggregation, maximum aggregation, etc.

[0138] With respect to step S1022, the goal of this step is to aggregate the traffic features received by all the neighboring nodes of the node from the node to obtain the aggregated outgoing features of the node.

[0139] For step S1023, for example, the initial node features are combined with the aggregated incoming and outgoing features, and processed by the update function (weighted sum and activation function) to obtain the comprehensive features of the node. This comprehensive feature more comprehensively reflects the state of the node and its interaction relationship with its neighbors.

[0140] The specific formulas of steps S1021-S1023 are as follows:

[0141]

[0142] in, is the aggregated incoming feature of the u-th node, Aggregate outgoing features of the u-th node, Neighbor in (u) is the set of all neighbor nodes passed to the u-th node. out (u) is the set of all neighbor nodes transmitted by the u-th node, is the initial node feature of the u-th node, is the updated comprehensive node feature of the u-th node.

[0143] For examples, see Figure 2 , Figure 2 A schematic diagram of the principle of determining the comprehensive node characteristics of a node provided by this application. Figure 2 As shown, when the comprehensive node features of node 1 need to be determined, the adjacent nodes of node 1 include node 2, node 3 and node 4, wherein the incoming node features include the incoming node features of node 2, the incoming node features of node 3 and the incoming node features of node 4, and the outgoing node features only include the outgoing node features from node 1 to node 2. Therefore, the aggregated incoming features are determined based on the incoming node features of node 2, the incoming node features of node 3 and the incoming node features of node 4, and the aggregated outgoing features are determined based only on the outgoing node features from node 1 to node 2.

[0144] For step S103, in this step, for each edge in the initial network traffic interaction graph, two nodes corresponding to the edge are determined, which are called the first node and the second node respectively. For the first node, all the incoming edges (first incoming edges) of the first node are determined, and the initial edge features of all the first incoming edges are obtained, and the initial edge features of the first incoming edges are aggregated to obtain the first aggregated features; for the second node, all the incoming edges (second incoming edges) of the second node are determined, and the initial edge features of all the second incoming edges are obtained, and the initial edge features of the second incoming edges are aggregated to obtain the second aggregated features.

[0145] Incoming edges are edges that point from other nodes to this node.

[0146] Among them, for the initial edge feature of the directed edge e = (u, v) The calculation formula of the aggregate feature is as follows:

[0147]

[0148] Where ω represents the weight of each edge. For example, when the edge has a time series attribute, the feature representation can be made more comprehensive by improving the weight. is the aggregate feature of the jth node on the edge. The method for determining the aggregate feature of another node i is similar to that of j, and will not be repeated here.

[0149] With respect to step S104, when performing edge feature update processing, it can be implemented by a multi-layer perceptron (MLP).

[0150] For examples, see Figure 3 , Figure 3 A schematic diagram of the principle of determining the comprehensive edge features of an edge provided by this application. Figure 3 As shown, is the initial node feature of the first node, for, is the initial node feature of the second node, is the first aggregation feature, is the second aggregation feature, is the initial edge feature of the nth edge, is the comprehensive edge feature of the nth edge.

[0151] With respect to step S105, the anomaly detection model is obtained by training an edge-integrated graph attention network.

[0152] The detection result indicates whether there is abnormal behavior (ie, whether there is abnormal traffic) in the target network. When the detection result indicates that the network traffic is abnormal, the specific abnormal type is also output.

[0153] For example, the anomaly types may include: reconnaissance attack, distributed denial of service, man-in-the-middle attack, replay attack, etc.

[0154] With respect to step S105, in one embodiment provided in the present application, the comprehensive node features of all nodes and the comprehensive edge features of all edges are input into a pre-trained anomaly detection model to determine the detection result of the network traffic in the target network, including:

[0155] S1051. Based on the interactive relationship between nodes and edges, the comprehensive node features of each node and the comprehensive edge features of each edge are weighted updated respectively through the edge attention layer in the anomaly detection model to obtain the output node features of each node and the output edge features of each edge.

[0156] S1052: Classify the output node features of all nodes and the output edge features of all edges through the MLP layer in the anomaly detection model to obtain network category features.

[0157] S1053. Normalize the network category features through the softmax layer in the anomaly detection model, and output the detection result of the network traffic in the target network.

[0158] For step S1051, through the edge attention mechanism, based on the interaction relationship between nodes and edges, the features of nodes and edges are weighted updated, so as to extract the output node features of each node and the output edge features of each edge.

[0159] When performing weighted update, the edge attention layer may include: for each node, the edge attention layer calculates the influence weight of each edge on the node, and updates the features of each node. For each edge, the edge attention layer calculates the weight between the edge and the connected node, thereby updating the features of each edge.

[0160] Among them, the comprehensive node features of all input nodes and the comprehensive edge features of all input edges can usually be expressed as node features and edge features Where N and F n Respectively represent the number of nodes and the number of node features. Similarly, M and F are used m represent the number of edges and the number of edge characteristics respectively.

[0161] With respect to step S1051, in one implementation provided in the present application, the output node feature of each node is determined by the following steps:

[0162] S11. Perform linear transformation on the comprehensive node features of all nodes and the comprehensive node features of all edges to obtain the linear node features of each node and the linear edge features of each edge in the same dimension.

[0163] S12, for each node, determine a node attention coefficient of any adjacent node relative to the node according to the linear node feature of the node, the linear node feature of any adjacent node corresponding to the node, and the linear edge feature of the connecting edge between the two nodes;

[0164] S13, performing normalization processing according to the node attention coefficients of all adjacent nodes relative to the node, and determining the node normalized attention weight of any adjacent node relative to the node;

[0165] S14, performing weighted update processing according to the node normalized attention weights of all adjacent nodes relative to the node, the linear node features of the adjacent nodes, and the linear edge features of the edge where the node is located, to obtain the output node features of the node.

[0166] With respect to step S11, when performing linear transformation processing, it can be implemented by multiplying with a weight matrix and adding a bias term.

[0167] For step S12, the formula corresponding to determining the node attention coefficient is:

[0168]

[0169] Among them, z ij represents the importance of the feature of node j to node i (node ​​attention coefficient), where W u , W v and W e are the network coefficients of the anomaly detection model, During model training, W u , W v and W e is the learnable weight matrix.

[0170] For step S13, the formula corresponding to the node normalized attention weight is determined as:

[0171]

[0172] The expanded form is:

[0173]

[0174] α ij Normalize the attention weight for the node, Node i is the set of neighbor nodes of node i, is the network coefficient of the anomaly detection model.

[0175] For step S14, the formula corresponding to the output node feature of the determined node is:

[0176]

[0177] With respect to step S1051, in one implementation provided in the present application, the output edge feature of each edge is determined by the following steps:

[0178] S21. For each edge, determine the structural score of the edge according to the out-degree of the source node and the in-degree of the target node on the edge.

[0179] S22. Determine an edge attention coefficient of the edge according to the structural score of the edge, the linear node features of the source node on the edge, the linear node features of the target node on the edge, and the linear edge features of the edge.

[0180] S23. Obtain the edge sensitivity of the edge, and perform normalization processing according to the edge sensitivity, the edge attention coefficient of the edge, and the edge attention coefficient of the edge where the target node is located to determine the edge normalized attention weight of the edge.

[0181] S24: Perform weighted update processing according to the edge normalized attention weight of the edge and the linear edge feature of the edge to obtain the output edge feature of the edge.

[0182] For step S21, the calculation formula of the structural score is:

[0183]

[0184] Among them, d out (i) and d in (j) represents the source node out-degree and target node in-degree of each edge, and D represents the sum of all degrees in the graph.

[0185] It should be noted that the importance of an edge is not only affected by the characteristics of the corresponding nodes and edges, but is also often related to the graph structure properties such as the degree of the nodes it connects to. Nodes with high out-degree or high in-degree usually have a more important position in the graph, so the edges connected to these nodes are also given higher importance scores.

[0186] For step S22, the calculation formula of the edge attention coefficient is:

[0187]

[0188] For step S23, the calculation formula of edge normalized attention weight is:

[0189]

[0190] Among them, Edge j represents the set of all edges whose target node is i, Represents the edge sensitivity, further adjusts the normalized attention weight, and improves the model's ability to capture graph structure details. ij It reflects the edge The importance of the edges relative to other edges in the entire feature update process (β ik is the normalized attention weight). In this way, by integrating the feature information of the edge and the edge sensitivity score, it is not only related to the impact of the edge on a single target node, but also reflects the position of the edge in the feature transfer and update process in the entire graph structure. Therefore, to a certain extent, the contribution of node features and edge features to the final representation is balanced, ensuring that the model not only pays attention to the features of the node itself, but also attaches importance to the connection relationship of the edge.

[0191] The edge sensitivity is determined by the following formula:

[0192]

[0193] In order to describe the edge sensitivity of the graph, the edge sensitivity parameter μ is used to reflect the contribution ratio of node features and edge features. Where λ represents the contribution ratio of node features and edge features when generating new node features, which is determined by the dimensions of node features and edge features. ε in the formula is a very small positive number to avoid the denominator being zero. Finally, the interval is mapped to (0,1) to obtain the edge sensitivity Sedge , to modify the edge sensitivity of the entire graph:

[0194]

[0195] It should be noted that the introduction of edge sensitivity can provide weight distribution for the combination of node features and edge features in subsequent models.

[0196] For step S24, the calculation formula of the output edge feature is as follows:

[0197]

[0198] is the output edge feature, Linear edge feature.

[0199] For step S1052, the output features of all nodes and edges are classified by a multi-layer perceptron (MLP) layer to obtain network category features. This process is to map the features to specific category labels, such as normal traffic or abnormal traffic.

[0200] The output of the MLP layer is a probability distribution about the category of each node and edge, indicating the category attribute of each node and edge in the network.

[0201] For step S1053, the network category features are normalized through the Softmax layer so that the output probability sum of the category features is 1, and the final network traffic detection result is obtained.

[0202] Through the output of the Softmax layer, the traffic detection results in the target network will be determined. The detection results may include two categories: "normal" or "abnormal", or more fine-grained category labels. This application can output more fine-grained category labels.

[0203] Therefore, the anomaly detection model involves multiple neural network modules (edge ​​attention mechanism, MLP and Softmax), each of which plays the role of extraction, classification and normalization, and finally outputs the detection result of whether the network traffic is normal.

[0204] With respect to the anomaly detection model described in step S105, in one implementation provided in the present application, the anomaly detection model is determined by the following steps:

[0205] S31. Obtain multiple sample network traffic interaction graphs in multiple experimental network environments, and determine the sample node features of the sample nodes and the sample edge features of the sample edges in each sample network traffic interaction graph; wherein each sample network traffic interaction graph is added with a real label.

[0206] S32. Input the sample node features of all sample nodes and the sample edge features of all sample edges in the sample network traffic interaction graph into the edge integrated graph attention network in turn to determine the prediction result of each sample network traffic interaction graph.

[0207] S33, determining at least one target loss function value according to the prediction result and the true label of each sample network traffic interaction graph;

[0208] S34. Iteratively update the network parameters of the edge-integrated graph attention network according to the at least one target loss function value and the preset learning rate strategy to obtain an anomaly detection model.

[0209] With respect to step S31, the experimental network is a network traffic simulation environment used to train and verify the model, and its purpose is to generate sample network traffic interaction graphs and provide a data set containing real labels for model training and evaluation.

[0210] The experimental network includes both normal traffic conditions and abnormal traffic conditions. When the abnormal traffic conditions are included, the corresponding real labels include specific abnormal types.

[0211] The real label may be added for each edge or for the entire network.

[0212] When a true label is added to each edge, the trained anomaly detection model can detect each edge and thus identify the abnormal edges.

[0213] For step S32, the edge-integrated graph attention network (EGAT) is used to extract and classify the sample features in the input sample traffic interaction graph to predict the state of the traffic interaction graph (normal or abnormal, and the type of abnormality).

[0214] For step S33, the difference between the model prediction result and the true label is evaluated by calculating the loss function, providing a basis for model parameter optimization.

[0215] For step S34, the network parameters include gradually adjusting the key hyperparameters of the neural network, including the learning rate, the edge importance weight coefficient, the embedding dimension, etc., to find the optimal configuration.

[0216] The update end condition may be that the update ends when the classification evaluation index requirements are met. Classification evaluation indicators may include accuracy, precision, recall, and F1 score, etc., to ensure that the model has a high detection effect in different scenarios. Specifically, an ROC curve can be drawn and the AUC value can be calculated to further analyze the performance of the model under different decision thresholds. By observing the changing trend of the AUC value, the overall separation ability of the model in anomaly detection can be judged, providing guidance for optimizing the threshold.

[0217] For example, in order to simulate the real attack scenario under high-density communication as much as possible, this study built a real industrial control network test platform based on the experimental conditions of existing projects and with the industrial control network as the background. The equipment of this platform is basically domestically produced, and the communication adopts Modbus TCP protocol. The simulation process lasted about 3 hours. There was no attack in the first hour. In the next two hours, network attacks were launched randomly and intermittently. In addition, in order to prevent the overlap of attacks, gaps were set between the attacks during the simulation, and the time required for the system to recover after each attack was reserved. Four types of network attacks were implemented in the test platform, including reconnaissance attack (Reconnaissance), distributed denial of service (DDoS), man-in-the-middle attack (MitM), and replay attack (Replay). When performing abnormal traffic detection, the traditional method relies on simple statistical indicators or single rule screening, resulting in frequent abnormal omissions and false alarms, unstable detection effect and lack of practicality. In the above background, the detection method of the present invention is introduced. In the first step, the communication data during the simulation process is collected and the data packets are processed using a flow generator; in the second step, the data flow is preprocessed and the corresponding network traffic interaction graph is constructed; in the third step, the node features and edge features are updated using the graph feature characterization method; in the fourth step, based on the graph features obtained in the third step, the EGAT model is used for adaptive learning to identify abnormal edge traffic; in the fifth step, various classification evaluation indicators are compared to optimize the model parameters.

[0218] The study conducted comparative experiments on the detection results of several common graph feature representation methods under different models. The experimental results show that the proposed detection method is significantly better than the traditional method in anomaly detection in high-frequency communication scenarios. It not only improves the accuracy of anomaly detection, but also realizes effective deployment in complex communication topology structures. The comparison results are shown in Table 1 below: Table 1 compares the abnormal edge detection effects of this research method and other methods under different models.

[0219] Table 1:

[0220]

[0221] The research results show that the edge-sensitive graph abnormal traffic edge detection method based on EGAT is significantly better than the traditional method and can detect the other five types of abnormal attack traffic. This method can be applied not only to network traffic detection in the field of network security, but also to abnormal edge detection in other industries.

[0222] In this way, this application fully captures the complex traffic interaction relationships in the network by constructing the initial network traffic interaction graph based on the communication endpoint information and traffic interaction information, ensuring the integrity and accuracy of the graph structure. Moreover, the features of the nodes and edges in the graph not only contain their own information, but also integrate the interaction relationships with adjacent nodes or edges, which helps to reflect the fine-grained characteristics in network traffic. This solution uses an edge-integrated graph attention network for training and anomaly detection, which can dynamically adjust the feature aggregation strategy according to the edge weights, is more sensitive to capturing key traffic interaction relationships, and effectively improves the model's ability to recognize abnormal patterns.

[0223] In summary, this scheme can significantly improve the accuracy of network traffic anomaly detection by constructing an initial network traffic interaction graph with edge-sensitive characteristics, fine-tuning and updating the node and edge features in the graph, and introducing an edge-integrated graph attention network, thus providing strong technical support for anomaly detection in the target network.

[0224] Based on the same inventive concept, a detection device corresponding to the detection method is also provided in the embodiment of the present application. Since the principle of solving the problem by the device in the embodiment of the present application is similar to the above-mentioned detection method in the embodiment of the present application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0225] See also Figure 4 , Figure 5 , Figure 4 This is one of the structural schematic diagrams of a network traffic detection device provided in an embodiment of the present application. Figure 5 This is a second structural diagram of a network traffic detection device provided in an embodiment of the present application. Figure 4 As shown in , the detection device 400 includes:

[0226] A construction module 410 is used to construct an initial network traffic interaction graph with edge-sensitive characteristics based on the communication endpoint information and traffic interaction information in the collected traffic data in the target network, and determine the initial node characteristics of each node and the initial edge characteristics of each edge in the initial network traffic interaction graph;

[0227] A first updating module 420 is used to perform node feature update processing for each node in the initial network traffic interaction graph according to the initial node feature of the node, the incoming node feature transmitted from each adjacent node to the node, and the outgoing node feature transmitted from the node to each adjacent node, so as to obtain the comprehensive node feature of the node;

[0228] A determination module 430 is used to determine, for each edge in the initial network traffic interaction graph, a first node and a second node corresponding to the edge, and determine a first aggregation feature of all incoming edges of the first node and a second aggregation feature of all incoming edges of the second node;

[0229] A second updating module 440 is used to perform edge feature update processing according to the initial edge feature of the edge, the initial node feature of the first node, the initial node feature of the second node, the first aggregate feature, and the second aggregate feature to obtain a comprehensive edge feature of the edge;

[0230] The detection module 450 is used to input the comprehensive node features of all nodes and the comprehensive edge features of all edges into a pre-trained anomaly detection model to determine the detection results of the network traffic in the target network; wherein the anomaly detection model is obtained by training the edge-integrated graph attention network.

[0231] Optionally, when the construction module 410 is used to construct an initial network traffic interaction graph with edge-sensitive characteristics according to the communication endpoint information and traffic interaction information in the collected traffic data in the target network, the construction module 410 is used to:

[0232] Collecting traffic data in the target network environment to obtain original network data packets;

[0233] Performing flow data processing on the original network data packet to determine the target network data flow;

[0234] Determine at least one node according to the communication endpoint information in the target network data flow, and determine at least one edge according to the traffic interaction information between the communication endpoints in the target network data flow;

[0235] The initial network traffic interaction graph is constructed based on all determined nodes and all edges.

[0236] Optionally, when the first updating module 420 is used to perform node feature update processing according to the initial node feature of the node, the incoming node feature transmitted from each adjacent node to the node, and the outgoing node feature transmitted from the node to each adjacent node to obtain the comprehensive node feature of the node, the first updating module 420 is used to:

[0237] Aggregate all incoming node features of the node to obtain the aggregated incoming features of the node;

[0238] Aggregate all outgoing node features of the node to obtain the aggregated outgoing features of the node;

[0239] According to the initial node feature of the node, the aggregated incoming feature of the node, and the aggregated incoming feature of the node, a node feature update process is performed to obtain a comprehensive node feature of the node.

[0240] Optionally, when the detection module 450 is used to input the comprehensive node features of all nodes and the comprehensive edge features of all edges into a pre-trained anomaly detection model to determine the detection result of the network traffic in the target network, the detection module 450 is used to:

[0241] Based on the interaction relationship between nodes and edges, the comprehensive node features of each node and the comprehensive edge features of each edge are weighted updated respectively through the edge attention layer in the anomaly detection model to obtain the output node features of each node and the output edge features of each edge;

[0242] Classify the output node features of all nodes and the output edge features of all edges through the MLP layer in the anomaly detection model to obtain network category features;

[0243] The network category features are normalized by the softmax layer in the anomaly detection model, and the detection result of the network traffic in the target network is output.

[0244] Optionally, the detection module 450 is further configured to determine the output node feature of each node through the following steps:

[0245] Perform linear transformation on the comprehensive node features of all nodes and the comprehensive node features of all edges to obtain the linear node features of each node and the linear edge features of each edge in the same dimension;

[0246] For each node, determine the node attention coefficient of any adjacent node relative to the node based on the linear node feature of the node, the linear node feature of any adjacent node corresponding to the node, and the linear edge feature of the connecting edge between the two nodes;

[0247] Performing normalization processing according to the node attention coefficients of all adjacent nodes relative to the node, determining the node normalized attention weight of any adjacent node relative to the node;

[0248] The output node feature of the node is obtained by performing weighted update processing according to the node normalized attention weights of all adjacent nodes relative to the node, the linear node features of the adjacent nodes, and the linear edge features of the edge where the node is located.

[0249] Optionally, the detection module 450 is further configured to determine the output edge feature of each edge through the following steps:

[0250] For each edge, determine the structural score of the edge based on the out-degree of the source node and the in-degree of the target node on the edge;

[0251] Determine an edge attention coefficient of the edge according to the structural score of the edge, the linear node feature of the source node on the edge, the linear node feature of the target node on the edge, and the linear edge feature of the edge;

[0252] Obtain the edge sensitivity of the edge, and perform normalization processing according to the edge sensitivity, the edge attention coefficient of the edge, and the edge attention coefficient of the edge where the target node is located, to determine the edge normalized attention weight of the edge;

[0253] A weighted update process is performed according to the edge normalized attention weight of the edge and the linear edge feature of the edge to obtain the output edge feature of the edge.

[0254] Optional, such as Figure 5 As shown, the detection device 400 further includes a training module 460, and the training module 460 is used to determine the anomaly detection model through the following steps:

[0255] Acquire multiple sample network traffic interaction graphs in multiple experimental network environments, and determine the sample node features of the sample nodes and the sample edge features of the sample edges in each sample network traffic interaction graph; wherein each sample network traffic interaction graph is added with a real label;

[0256] Inputting the sample node features of all sample nodes and the sample edge features of all sample edges in the sample network traffic interaction graph into the edge integration graph attention network in turn to determine the prediction result of each sample network traffic interaction graph;

[0257] Determine at least one target loss function value according to the prediction result and the true label of each sample network traffic interaction graph;

[0258] The network parameters of the edge-integrated graph attention network are iteratively updated according to the at least one target loss function value and a preset learning rate strategy to obtain an anomaly detection model.

[0259] See also Figure 6 , Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 6As shown in , the electronic device 600 includes a processor 610 , a memory 620 and a bus 630 .

[0260] The memory 620 stores machine-readable instructions executable by the processor 610. When the electronic device 600 is running, the processor 610 communicates with the memory 620 via the bus 630. When the machine-readable instructions are executed by the processor 610, the above-mentioned Figures 1 to 3 The specific implementation of the steps in the method embodiment shown can be found in the method embodiment, and will not be repeated here.

[0261] The present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the computer program can execute the above-mentioned Figures 1 to 3 The specific implementation of the steps in the method embodiment shown can be found in the method embodiment, and will not be repeated here.

[0262] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0263] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0264] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0265] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0266] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application can essentially be embodied in the form of a software product, or in other words, the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0267] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-mentioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for detecting network traffic, characterized in that: The detection method comprises: According to the communication endpoint information and traffic interaction information in the collected traffic data in the target network, an initial network traffic interaction graph with edge-sensitive characteristics is constructed, and the initial node characteristics of each node and the initial edge characteristics of each edge in the initial network traffic interaction graph are determined; For each node in the initial network traffic interaction graph, node feature update processing is performed according to the initial node feature of the node, the incoming node feature transmitted from each adjacent node to the node, and the outgoing node feature transmitted from the node to each adjacent node to obtain the comprehensive node feature of the node; For each edge in the initial network traffic interaction graph, determine a first node and a second node corresponding to the edge, and determine a first aggregation feature of all incoming edges of the first node and a second aggregation feature of all incoming edges of the second node; Perform edge feature update processing according to the initial edge feature of the edge, the initial node feature of the first node, the initial node feature of the second node, the first aggregate feature, and the second aggregate feature to obtain a comprehensive edge feature of the edge; The comprehensive node features of all nodes and the comprehensive edge features of all edges are input into a pre-trained anomaly detection model to determine the detection result of the network traffic in the target network; wherein the anomaly detection model is obtained by training the edge-integrated graph attention network.

2. The detection method according to claim 1, characterized in that: The method of constructing an initial network traffic interaction graph with edge-sensitive characteristics according to the communication endpoint information and traffic interaction information in the collected traffic data in the target network includes: Collecting traffic data in the target network environment to obtain original network data packets; Performing flow data processing on the original network data packet to determine the target network data flow; Determine at least one node according to the communication endpoint information in the target network data flow, and determine at least one edge according to the traffic interaction information between the communication endpoints in the target network data flow; The initial network traffic interaction graph is constructed based on all determined nodes and all edges.

3. The detection method according to claim 1, characterized in that: The node feature update process is performed according to the initial node feature of the node, the incoming node feature transmitted from each adjacent node to the node, and the outgoing node feature transmitted from the node to each adjacent node to obtain the comprehensive node feature of the node, including: Aggregate all incoming node features of the node to obtain the aggregated incoming features of the node; Aggregate all outgoing node features of the node to obtain the aggregated outgoing features of the node; According to the initial node feature of the node, the aggregated incoming feature of the node, and the aggregated incoming feature of the node, a node feature update process is performed to obtain a comprehensive node feature of the node.

4. The detection method according to claim 1, characterized in that: The integrated node features of all nodes and the integrated edge features of all edges are input into a pre-trained anomaly detection model to determine the detection result of the network traffic in the target network, including: Based on the interaction relationship between nodes and edges, the comprehensive node features of each node and the comprehensive edge features of each edge are weighted updated respectively through the edge attention layer in the anomaly detection model to obtain the output node features of each node and the output edge features of each edge; Classify the output node features of all nodes and the output edge features of all edges through the MLP layer in the anomaly detection model to obtain network category features; The network category features are normalized by the softmax layer in the anomaly detection model, and the detection result of the network traffic in the target network is output.

5. The detection method according to claim 4, characterized in that: The output node characteristics of each node are determined by the following steps: Perform linear transformation on the comprehensive node features of all nodes and the comprehensive node features of all edges to obtain the linear node features of each node and the linear edge features of each edge in the same dimension; For each node, determine the node attention coefficient of any adjacent node relative to the node based on the linear node feature of the node, the linear node feature of any adjacent node corresponding to the node, and the linear edge feature of the connecting edge between the two nodes; Performing normalization processing according to the node attention coefficients of all adjacent nodes relative to the node, determining the node normalized attention weight of any adjacent node relative to the node; The output node feature of the node is obtained by performing weighted update processing according to the node normalized attention weights of all adjacent nodes relative to the node, the linear node features of the adjacent nodes, and the linear edge features of the edge where the node is located.

6. The detection method according to claim 5, characterized in that: The output edge characteristics of each edge are determined by the following steps: For each edge, determine the structural score of the edge based on the out-degree of the source node and the in-degree of the target node on the edge; Determine an edge attention coefficient of the edge according to the structural score of the edge, the linear node feature of the source node on the edge, the linear node feature of the target node on the edge, and the linear edge feature of the edge; Obtain the edge sensitivity of the edge, and perform normalization processing according to the edge sensitivity, the edge attention coefficient of the edge, and the edge attention coefficient of the edge where the target node is located, to determine the edge normalized attention weight of the edge; A weighted update process is performed according to the edge normalized attention weight of the edge and the linear edge feature of the edge to obtain the output edge feature of the edge.

7. The detection method according to claim 1, characterized in that: Determine the anomaly detection model by following these steps: Acquire multiple sample network traffic interaction graphs in multiple experimental network environments, and determine the sample node features of the sample nodes and the sample edge features of the sample edges in each sample network traffic interaction graph; wherein each sample network traffic interaction graph is added with a real label; Inputting the sample node features of all sample nodes and the sample edge features of all sample edges in the sample network traffic interaction graph into the edge integration graph attention network in turn to determine the prediction result of each sample network traffic interaction graph; Determine at least one target loss function value according to the prediction result and the true label of each sample network traffic interaction graph; The network parameters of the edge-integrated graph attention network are iteratively updated according to the at least one target loss function value and a preset learning rate strategy to obtain an anomaly detection model.

8. A network traffic detection device, characterized in that: The detection device comprises: A construction module is used to construct an initial network traffic interaction graph with edge-sensitive characteristics based on the communication endpoint information and traffic interaction information in the collected traffic data in the target network, and determine the initial node characteristics of each node and the initial edge characteristics of each edge in the initial network traffic interaction graph; A first updating module is used to perform node feature updating processing for each node in the initial network traffic interaction graph according to the initial node feature of the node, the incoming node feature transmitted from each adjacent node to the node, and the outgoing node feature transmitted from the node to each adjacent node, so as to obtain the comprehensive node feature of the node; A determination module, configured to determine, for each edge in the initial network traffic interaction graph, a first node and a second node corresponding to the edge, and determine a first aggregation feature of all incoming edges of the first node and a second aggregation feature of all incoming edges of the second node; A second updating module is used to perform edge feature updating processing according to the initial edge feature of the edge, the initial node feature of the first node, the initial node feature of the second node, the first aggregate feature, and the second aggregate feature to obtain a comprehensive edge feature of the edge; A detection module is used to input the comprehensive node features of all nodes and the comprehensive edge features of all edges into a pre-trained anomaly detection model to determine the detection results of network traffic in the target network; wherein the anomaly detection model is obtained by training an edge-integrated graph attention network.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and the machine-readable instructions are executed by the processor to execute the steps of the detection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the detection method according to any one of claims 1 to 7 are executed.

Images