A network traffic detection method and device, electronic equipment and storage medium

Abstract

This application provides a method, apparatus, electronic device, and storage medium for detecting network traffic. The method includes: constructing an initial network traffic interaction graph based on traffic data in a target network; for each node in the interaction graph, updating the graph based on its initial node features, incoming node features, and outgoing node features to obtain a comprehensive node feature; for each edge in the interaction graph, determining the first aggregate feature of the first node and the second aggregate feature of the second node corresponding to the edge, and updating the graph based on the initial edge features, the initial node features of the first node, and the initial node features of the second node to obtain a comprehensive edge feature; and inputting all comprehensive node features and all comprehensive edge features into an anomaly detection model to determine the detection result. Thus, this solution, by optimizing the graph feature representation method, can more accurately identify abnormal traffic in the network.

Description

Technical Field

[0001] This application relates to the field of network detection technology, and in particular to a method, apparatus, electronic device, and storage medium for detecting network traffic. Background Technology

[0002] With the continuous development of network communication technology, high-frequency communication scenarios are becoming increasingly common in modern communication networks, especially in fields such as industrial control networks, the Internet of Things (IoT), and real-time data analysis. In these scenarios, the number of network devices is relatively small, but the data transmission between them is dense and the communication frequency is very high. Attackers often employ various attack methods to conceal themselves within these scenarios, and the high density of communication information provides a natural barrier for attackers, undoubtedly posing new challenges to the detection of abnormal network traffic.

[0003] Anomaly detection, as a crucial means of ensuring network security and stable operation, primarily aims to identify abnormal patterns and behaviors within the network by analyzing traffic data. With the increasing frequency and complexity of network communication, traditional anomaly detection methods mainly include statistical methods and machine learning-based methods, such as support vector machines and random forests. These methods primarily focus on the statistical characteristics of traffic between devices. While these methods improve detection accuracy to some extent, attackers can still use various techniques to disguise traffic as normal to bypass anomaly detection models. Furthermore, when fully utilizing the temporal characteristics and network topology features in traffic data, attackers need to expend significant resources to alter these patterns. To address the evolving complex attack patterns and fully leverage the temporal and spatial topological information in traffic data, graph-based anomaly detection methods have emerged.

[0004] Graph-based anomaly detection methods can effectively handle large-scale networks and mine deep topological information. Currently, graph-based anomaly detection technology has a very wide range of applications, such as attacks in financial networks, unauthorized intrusions and malicious traffic attacks in communication networks, and potential advanced persistent threats in industrial control networks. These attacks pose serious threats to users and society. Therefore, in the context of increasingly frequent data interactions and increasingly sophisticated attack methods, graph anomaly detection methods, as one of the key technologies in data security and network security, possess rich scientific research value and practical significance.

[0005] However, existing graph-based anomaly traffic detection models mainly rely on aggregating node features to mine network topology information. When faced with high-density traffic data, frequent interactions between nodes lead to a large number of multi-edge phenomena in the network, meaning that multiple edges exist between the same pair of nodes within a short period of time. This situation makes the network structure extremely complex, causing the trained graph model to perform poorly in complex, high-density communication scenarios and fail to accurately identify anomalies. Summary of the Invention

[0006] In view of this, the purpose of this application is to provide a method, device, electronic device and storage medium for detecting network traffic. By optimizing the graph feature representation method, abnormal traffic in the network can be identified more accurately, thereby providing stronger protection for subsequent network security decisions.

[0007] This application provides a method for detecting network traffic, the method comprising:

[0008] Based on the communication endpoint information and traffic interaction information in the traffic data collected from the target network, an initial network traffic interaction graph with edge sensitivity is constructed, and the initial node characteristics of each node and the initial edge characteristics of each edge in the initial network traffic interaction graph are determined.

[0009] For each node in the initial network traffic interaction graph, node feature update processing is performed based on the initial node features of the node, the incoming node features transmitted from each adjacent node to the node, and the outgoing node features transmitted from the node to each adjacent node, to obtain the comprehensive node features of the node.

[0010] For each edge in the initial network traffic interaction graph, determine the first node and the second node corresponding to the edge, and determine the first aggregate feature of all incoming edges of the first node and the second aggregate feature of all incoming edges of the second node;

[0011] Based on the initial edge features, the initial node features of the first node, the initial node features of the second node, the first aggregate feature, and the second aggregate feature, edge feature update processing is performed to obtain the comprehensive edge features of the edge.

[0012] The combined node features of all nodes and the combined edge features of all edges are input into a pre-trained anomaly detection model to determine the detection results of network traffic in the target network; wherein, the anomaly detection model is obtained by training an edge-integrated graph attention network.

[0013] Optionally, the step of constructing an initial network traffic interaction graph with edge-sensitive characteristics based on the communication endpoint information and traffic interaction information in the collected traffic data of the target network includes:

[0014] Traffic data in the target network environment is collected to obtain raw network data packets;

[0015] Perform stream data processing on the original network data packets to determine the target network data stream;

[0016] Based on the communication endpoint information in the target network data stream, at least one node is determined, and based on the traffic interaction information between the communication endpoints in the target network data stream, at least one edge is determined.

[0017] Based on all identified nodes and edges, construct the initial network traffic interaction graph.

[0018] Optionally, the step of performing node feature update processing based on the initial node features of the node, the incoming node features transmitted from each neighboring node to the node, and the outgoing node features transmitted from the node to each neighboring node to obtain the comprehensive node features of the node includes:

[0019] Aggregate all incoming node features for this node to obtain the aggregated incoming features for this node;

[0020] Aggregate the features of all outgoing nodes of this node to obtain the aggregated outgoing features of this node.

[0021] Based on the initial node features, the aggregated incoming features, and the aggregated incoming features of the node, node feature update processing is performed to obtain the comprehensive node features of the node.

[0022] Optionally, the step of inputting the comprehensive node features of all nodes and the comprehensive edge features of all edges into a pre-trained anomaly detection model to determine the detection result of network traffic in the target network includes:

[0023] Based on the interaction between nodes and edges, the comprehensive node features of each node and the comprehensive edge features of each edge are weighted and updated through the edge attention layer in the anomaly detection model to obtain the output node features of each node and the output edge features of each edge.

[0024] The network category features are obtained by classifying the output node features of all nodes and the output edge features of all edges through the MLP layer in the anomaly detection model.

[0025] The network category features are normalized by the softmax layer in the anomaly detection model, and the detection results of network traffic in the target network are output.

[0026] Optionally, the output node characteristics of each node can be determined through the following steps:

[0027] A linear transformation is performed on the combined node features of all nodes and the combined node features of all edges to obtain the linear node features of each node and the linear edge features of each edge under the same dimension.

[0028] For each node, the node attention coefficient of any adjacent node relative to the node is determined based on the linear node characteristics of the node, the linear node characteristics of any adjacent node of the node, and the linear edge characteristics of the connecting edge between the two nodes.

[0029] The node attention coefficients of all neighboring nodes relative to this node are normalized to determine the normalized attention weight of any neighboring node relative to this node.

[0030] The output node features of a node are obtained by weighting and updating the node based on the normalized attention weights of all neighboring nodes relative to the node, the linear node features of the neighboring nodes, and the linear edge features of the edge containing the node.

[0031] Optionally, the output edge features of each edge can be determined through the following steps:

[0032] For each edge, determine the structural score of the edge based on the out-degree of the source node and the in-degree of the target node on that edge;

[0033] The edge attention coefficient is determined based on the structural score of the edge, the linear node features of the source node on the edge, the linear node features of the target node on the edge, and the linear edge features of the edge.

[0034] Obtain the edge sensitivity of the edge, and normalize it based on the edge sensitivity, the edge attention coefficient of the edge, and the edge attention coefficient of the edge containing the target node to determine the edge normalized attention weight of the edge.

[0035] The edge features are obtained by performing a weighted update process based on the edge normalization attention weight and the linear edge features of the edge.

[0036] Optionally, the anomaly detection model can be determined through the following steps:

[0037] Multiple sample network traffic interaction graphs were obtained from multiple experimental network environments, and the sample node features and sample edge features of sample nodes and sample edges in each sample network traffic interaction graph were determined; each sample network traffic interaction graph was labeled with a real label.

[0038] The sample node features of all sample nodes and the sample edge features of all sample edges in the sample network traffic interaction graph are sequentially input into the edge ensemble graph attention network to determine the prediction result of each sample network traffic interaction graph.

[0039] Based on the prediction results and true labels of the network traffic interaction graph for each sample, determine at least one target loss function value;

[0040] The network parameters of the edge-integrated graph attention network are iteratively updated based on the at least one target loss function value and the preset learning rate strategy to obtain the anomaly detection model.

[0041] This application embodiment also provides a network traffic detection device, the detection device comprising:

[0042] The construction module is used to construct an initial network traffic interaction graph with edge sensitivity based on the communication endpoint information and traffic interaction information in the traffic data of the collected target network, and to determine the initial node characteristics of each node and the initial edge characteristics of each edge in the initial network traffic interaction graph.

[0043] The first update module is used to perform node feature update processing on each node in the initial network traffic interaction graph, based on the initial node features of the node, the incoming node features transmitted from each adjacent node to the node, and the outgoing node features transmitted from the node to each adjacent node, to obtain the comprehensive node features of the node.

[0044] The determination module is used to determine the first node and the second node corresponding to each edge in the initial network traffic interaction graph, and to determine the first aggregate feature of all incoming edges of the first node and the second aggregate feature of all incoming edges of the second node.

[0045] The second update module is used to perform edge feature update processing based on the initial edge features of the edge, the initial node features of the first node, the initial node features of the second node, the first aggregation feature, and the second aggregation feature to obtain the comprehensive edge features of the edge.

[0046] The detection module is used to input the comprehensive node features of all nodes and the comprehensive edge features of all edges into a pre-trained anomaly detection model to determine the detection results of network traffic in the target network; wherein, the anomaly detection model is obtained by training an edge-integrated graph attention network.

[0047] Optionally, when constructing an initial network traffic interaction graph with edge-sensitive characteristics based on communication endpoint information and traffic interaction information in the collected traffic data of the target network, the construction module is used to:

[0048] Traffic data in the target network environment is collected to obtain raw network data packets;

[0049] Perform stream data processing on the original network data packets to determine the target network data stream;

[0050] Based on the communication endpoint information in the target network data stream, at least one node is determined, and based on the traffic interaction information between the communication endpoints in the target network data stream, at least one edge is determined.

[0051] Based on all identified nodes and edges, construct the initial network traffic interaction graph.

[0052] Optionally, when the first update module performs node feature update processing based on the initial node features of the node, the incoming node features transmitted from each neighboring node to the node, and the outgoing node features transmitted from the node to each neighboring node to obtain the comprehensive node features of the node, the first update module is used to:

[0053] Aggregate all incoming node features for this node to obtain the aggregated incoming features for this node;

[0054] Aggregate the features of all outgoing nodes of this node to obtain the aggregated outgoing features of this node.

[0055] Based on the initial node features, the aggregated incoming features, and the aggregated incoming features of the node, node feature update processing is performed to obtain the comprehensive node features of the node.

[0056] Optionally, when the detection module inputs the comprehensive node features of all nodes and the comprehensive edge features of all edges into a pre-trained anomaly detection model to determine the detection result of network traffic in the target network, the detection module is used to:

[0057] Based on the interaction between nodes and edges, the comprehensive node features of each node and the comprehensive edge features of each edge are weighted and updated through the edge attention layer in the anomaly detection model to obtain the output node features of each node and the output edge features of each edge.

[0058] The network category features are obtained by classifying the output node features of all nodes and the output edge features of all edges through the MLP layer in the anomaly detection model.

[0059] The network category features are normalized by the softmax layer in the anomaly detection model, and the detection results of network traffic in the target network are output.

[0060] Optionally, the detection module is further configured to determine the output node features of each node through the following steps:

[0061] A linear transformation is performed on the combined node features of all nodes and the combined node features of all edges to obtain the linear node features of each node and the linear edge features of each edge under the same dimension.

[0062] For each node, the node attention coefficient of any adjacent node relative to the node is determined based on the linear node characteristics of the node, the linear node characteristics of any adjacent node of the node, and the linear edge characteristics of the connecting edge between the two nodes.

[0063] The node attention coefficients of all neighboring nodes relative to this node are normalized to determine the normalized attention weight of any neighboring node relative to this node.

[0064] The output node features of a node are obtained by weighting and updating the node based on the normalized attention weights of all neighboring nodes relative to the node, the linear node features of the neighboring nodes, and the linear edge features of the edge containing the node.

[0065] Optionally, the detection module is further configured to determine the output edge features of each edge through the following steps:

[0066] For each edge, determine the structural score of the edge based on the out-degree of the source node and the in-degree of the target node on that edge;

[0067] The edge attention coefficient is determined based on the structural score of the edge, the linear node features of the source node on the edge, the linear node features of the target node on the edge, and the linear edge features of the edge.

[0068] Obtain the edge sensitivity of the edge, and normalize it based on the edge sensitivity, the edge attention coefficient of the edge, and the edge attention coefficient of the edge containing the target node to determine the edge normalized attention weight of the edge.

[0069] The edge features are obtained by performing a weighted update process based on the edge normalization attention weight and the linear edge features of the edge.

[0070] Optionally, the detection device further includes a training module, which is used to determine an anomaly detection model through the following steps:

[0071] Multiple sample network traffic interaction graphs were obtained from multiple experimental network environments, and the sample node features and sample edge features of sample nodes and sample edges in each sample network traffic interaction graph were determined; each sample network traffic interaction graph was labeled with a real label.

[0072] The sample node features of all sample nodes and the sample edge features of all sample edges in the sample network traffic interaction graph are sequentially input into the edge ensemble graph attention network to determine the prediction result of each sample network traffic interaction graph.

[0073] Based on the prediction results and true labels of the network traffic interaction graph for each sample, determine at least one target loss function value;

[0074] The network parameters of the edge-integrated graph attention network are iteratively updated based on the at least one target loss function value and the preset learning rate strategy to obtain the anomaly detection model.

[0075] This application also provides an electronic device, including: a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, the steps of the detection method described above are performed.

[0076] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the detection method described above.

[0077] This application provides a method, apparatus, electronic device, and storage medium for detecting network traffic. The detection method includes: constructing an initial network traffic interaction graph with edge-sensitive characteristics based on communication endpoint information and traffic interaction information in the traffic data collected from the target network; determining the initial node characteristics of each node and the initial edge characteristics of each edge in the initial network traffic interaction graph; for each node in the initial network traffic interaction graph, performing node feature update processing based on the initial node characteristics of the node, the incoming node characteristics transmitted from each adjacent node to the node, and the outgoing node characteristics transmitted from the node to each adjacent node, to obtain the comprehensive node characteristics of the node; for the initial node characteristics of the target network traffic interaction graph, constructing an initial network traffic interaction graph with edge-sensitive characteristics based on communication endpoint information and traffic interaction information in the traffic data collected from the target network traffic interaction graph, and ...; for the initial node characteristics of each node, performing node feature update processing based on the initial node characteristics of the node, the incoming node characteristics of each adjacent node, and the outgoing node characteristics of each adjacent node, to obtain the comprehensive node characteristics of the node; for the initial node characteristics of each adjacent node, performing node feature update processing based on the initial node characteristics of the node, the initial node characteristics of the node, the initial node characteristics of the node, the initial node characteristics of the node, the initial node characteristics of the node, the initial node characteristics of the node, the initial node characteristics of the node, the initial node characteristics of the node, the initial node characteristics of the node, the initial node characteristics of the node, the initial node characteristics of the node, the initial node characteristics of the node, the initial node characteristics of For each edge in the initial network traffic interaction graph, determine the first and second nodes corresponding to that edge, and determine the first aggregate feature of all incoming edges of the first node and the second aggregate feature of all incoming edges of the second node. Based on the initial edge feature, the initial node feature of the first node, the initial node feature of the second node, the first aggregate feature, and the second aggregate feature, perform edge feature update processing to obtain the comprehensive edge feature of that edge. Input the comprehensive node feature of all nodes and the comprehensive edge feature of all edges into a pre-trained anomaly detection model to determine the detection result of network traffic in the target network. The anomaly detection model is obtained by training an edge-integrated graph attention network.

[0078] In this way, this application constructs an initial network traffic interaction graph by combining communication endpoint information and traffic interaction information, fully capturing the complex traffic interaction relationships in the network and ensuring the integrity and accuracy of the graph structure. Furthermore, the features of nodes and edges in the graph not only contain their own information but also incorporate their interaction relationships with adjacent nodes or edges, helping to reflect the fine-grained characteristics of network traffic. This scheme uses an edge-integrated graph attention network for training and anomaly detection, which can dynamically adjust the feature aggregation strategy according to the edge weights, making it more sensitive to capturing key traffic interaction relationships and effectively improving the model's ability to identify abnormal patterns.

[0079] In summary, this solution significantly improves the accuracy of network traffic anomaly detection by constructing an initial network traffic interaction graph with edge-sensitive characteristics, performing refined modeling and updating of node and edge features in the graph, and introducing an edge-integrated graph attention network, thus providing strong technical support for anomaly detection in target networks.

[0080] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0081] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0082] Figure 1 A flowchart illustrating a network traffic detection method provided in an embodiment of this application;

[0083] Figure 2 A schematic diagram illustrating the principle of determining the comprehensive node characteristics of a node, as provided in this application;

[0084] Figure 3 A schematic diagram illustrating the principle of determining the comprehensive edge characteristics for this application;

[0085] Figure 4 This is one of the structural schematic diagrams of a network traffic detection device provided in an embodiment of this application;

[0086] Figure 5 This is a second schematic diagram of a network traffic detection device provided in an embodiment of this application;

[0087] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0088] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. Based on the embodiments of this application, every other embodiment obtained by those skilled in the art without inventive effort falls within the scope of protection of this application.

[0089] With the continuous development of network communication technology, high-frequency communication scenarios are becoming increasingly common in modern communication networks, especially in fields such as industrial control networks, the Internet of Things (IoT), and real-time data analysis. In these scenarios, the number of network devices is relatively small, but the data transmission between them is dense and the communication frequency is very high. Attackers often employ various attack methods to conceal themselves within these scenarios, and the high density of communication information provides a natural barrier for attackers, undoubtedly posing new challenges to the detection of abnormal network traffic.

[0090] Anomaly detection, as a crucial means of ensuring network security and stable operation, primarily aims to identify abnormal patterns and behaviors within the network by analyzing traffic data. With the increasing frequency and complexity of network communication, traditional anomaly detection methods mainly include statistical methods and machine learning-based methods, such as support vector machines and random forests. These methods primarily focus on the statistical characteristics of traffic between devices. While these methods improve detection accuracy to some extent, attackers can still use various techniques to disguise traffic as normal to bypass anomaly detection models. Furthermore, when fully utilizing the temporal characteristics and network topology features in traffic data, attackers need to expend significant resources to alter these patterns. To address the evolving complex attack patterns and fully leverage the temporal and spatial topological information in traffic data, graph-based anomaly detection methods have emerged.

[0091] Graph-based anomaly detection methods can effectively handle large-scale networks and mine deep topological information. Currently, graph-based anomaly detection technology has a very wide range of applications, such as attacks in financial networks, unauthorized intrusions and malicious traffic attacks in communication networks, and potential advanced persistent threats in industrial control networks. These attacks pose serious threats to users and society. Therefore, in the context of increasingly frequent data interactions and increasingly sophisticated attack methods, graph anomaly detection methods, as one of the key technologies in data security and network security, possess rich scientific research value and practical significance.

[0092] However, existing graph-based anomaly traffic detection models mainly rely on aggregating node features to mine network topology information. When faced with high-density traffic data, frequent interactions between nodes lead to a large number of multi-edge phenomena in the network, meaning that multiple edges exist between the same pair of nodes within a short period of time. This situation makes the network structure extremely complex, causing the trained graph model to perform poorly in complex, high-density communication scenarios and fail to accurately identify anomalies.

[0093] Based on this, embodiments of this application provide a method, apparatus, electronic device, and storage medium for detecting network traffic. By optimizing the graph feature representation method, abnormal traffic in the network can be identified more accurately, thereby providing stronger protection for subsequent network security decisions.

[0094] Please see Figure 1 , Figure 1 This is a flowchart illustrating a network traffic detection method provided in an embodiment of this application. Figure 1 As shown in the embodiments of this application, the detection method includes:

[0095] S101. Based on the communication endpoint information and traffic interaction information in the traffic data of the collected target network, construct an initial network traffic interaction graph with edge sensitivity, and determine the initial node characteristics of each node and the initial edge characteristics of each edge in the initial network traffic interaction graph.

[0096] S102. For each node in the initial network traffic interaction graph, perform node feature update processing based on the initial node features of the node, the incoming node features transmitted from each adjacent node to the node, and the outgoing node features transmitted from the node to each adjacent node, to obtain the comprehensive node features of the node.

[0097] S103. For each edge in the initial network traffic interaction graph, determine the first node and the second node corresponding to the edge, and determine the first aggregation feature of all incoming edges of the first node and the second aggregation feature of all incoming edges of the second node.

[0098] S104. Based on the initial edge features of the edge, the initial node features of the first node, the initial node features of the second node, the first aggregation feature, and the second aggregation feature, perform edge feature update processing to obtain the comprehensive edge features of the edge.

[0099] S105. Input the comprehensive node features of all nodes and the comprehensive edge features of all edges into the pre-trained anomaly detection model to determine the detection results of network traffic in the target network.

[0100] Regarding step S101, when it is necessary to detect the traffic status in the target network, traffic data at the current moment or traffic data within a specified time period in the target network is collected according to a preset collection strategy; then the collected traffic data is analyzed to determine the communication endpoint information and traffic interaction information included therein; then, based on the included communication endpoint information and traffic interaction information, an initial network traffic interaction graph is constructed, and the initial node characteristics of each node and the initial edge characteristics of each edge in the initial network traffic interaction graph are determined.

[0101] Here, the initial network traffic interaction graph is an edge-sensitive initial network traffic interaction graph, and the initial network traffic interaction graph is a directed multigraph. The initial network traffic interaction graph includes multiple nodes and multiple edges. There may be one or more edges between two nodes, and each node or edge is assigned a unique identifier (e.g., an ID).

[0102] The target network refers to the network that needs to be monitored and analyzed, which may be an enterprise network, a data center network, a cloud platform, an industrial control network, etc.

[0103] The traffic data refers to the metadata of data packets transmitted in the network through devices such as switches and routers (such as source IP, destination IP, port number, protocol type, transmission delay, data packet size, data flow direction, TCP and UDP traffic, ARP protocol messages, timestamps, etc.).

[0104] Communication endpoint information refers to the identification information of devices or hosts communicating in a network, which typically includes source IP address, destination IP address, port number, etc.

[0105] Traffic interaction information describes the interaction behavior between different communication endpoints and typically includes information such as the transmission direction of data packets, data volume, protocol type, and transmission delay.

[0106] The initial network traffic interaction graph is a graph structure composed of nodes and edges, where each node represents a communication endpoint and each edge represents the traffic interaction between two communication endpoints.

[0107] Edge sensitivity means that the edges in a graph not only reflect the connections between nodes, but also need to consider the characteristics of traffic interactions, such as data volume, interaction frequency, and traffic timeliness. These characteristics are used as edge features when constructing the graph.

[0108] Node characteristics are attribute information describing each node, such as IP address, device type, total traffic, activity level, etc.

[0109] Edge features: describe the interaction information between nodes, which may include data packet size, transmission latency, interaction frequency, etc.

[0110] Regarding step S101, in one embodiment provided in this application, constructing an initial network traffic interaction graph with edge-sensitive characteristics based on communication endpoint information and traffic interaction information in the collected traffic data of the target network includes:

[0111] S1011. Collect traffic data in the target network environment to obtain raw network data packets.

[0112] S1012. Perform stream data processing on the original network data packets to determine the target network data stream.

[0113] S1013. Based on the communication endpoint information in the target network data stream, determine at least one node, and based on the traffic interaction information between the communication endpoints in the target network data stream, determine at least one edge.

[0114] S1014. Construct the initial network traffic interaction graph based on all determined nodes and edges.

[0115] For step S1011, traffic data in the target network environment can be collected by security monitoring equipment to obtain raw network data packets.

[0116] Security monitoring equipment is deployed in critical locations within the network to ensure the collection of communication traffic between all major network nodes. This equipment may include intrusion detection systems (IDS), traffic monitoring devices, and packet capture tools to ensure comprehensive coverage and capture of network data in high-frequency communication environments. The monitoring equipment should be capable of real-time traffic collection and possess efficient storage and processing capabilities to handle the demands of collecting large volumes of traffic data.

[0117] The data in the raw network packets may include TCP and UDP traffic, ARP protocol messages, and information such as timestamps, source and destination MAC addresses, and IP addresses. This information can be captured in a PCAP file and categorized according to timestamps and traffic direction, ensuring that attack traffic can be reconstructed and classified during the data analysis phase.

[0118] In step S1012, the stream generator is used to parse the original network data packets (PCAP file), extract the data packet data into the required stream data, and obtain the target network data stream.

[0119] In this context, a network data flow refers to a collection of consecutive data packets transmitted between two communication endpoints within a certain time window. These data packets share the same attributes such as source IP, destination IP, source port, and destination port, and are typically grouped by flow. A network flow can consist of multiple data packets, representing communication between a source device and a destination device.

[0120] Regarding step S1013, a communication endpoint refers to a device in the network that sends or receives data packets (such as a server, router, terminal device, etc.). Each communication endpoint is usually assigned a unique identifier (IP address, or MAC address, or ID).

[0121] In a network traffic interaction graph, nodes represent communication endpoints, which are typically identified by information about the communication endpoints in the target network data flow. Each communication endpoint (such as an IP address and port) corresponds to a node in the graph.

[0122] Traffic interaction information refers to the specific data transmission details between two communication endpoints, such as data volume, transmission rate, and latency. For each pair of communication endpoints, there will be at least one edge, and the characteristics of the edge reflect the communication behavior between the two nodes.

[0123] For example, directed edges are distinguished according to communication direction, and a heterogeneous network interaction graph with three edge types is constructed: "IP-connect-IP", "MAC-connect-MAC", and "IP-belongs to-MAC". The first two represent data flow transmission edges between communication nodes, while the latter only represents the subordinate relationship between IP and MAC.

[0124] For step S1014, a graph structure is formed by combining all nodes (communication endpoints) and edges (traffic interactions between nodes), thus determining the initial network traffic interaction graph. Each node represents a communication endpoint, and each edge represents the traffic interaction between two endpoints.

[0125] Furthermore, if the target network is monitored in real time, the determined initial network traffic interaction graph can be updated based on the current traffic data to update the previous network traffic interaction graph. For example, the current nodes and edges are determined based on the current traffic data, and then the determined nodes and edges are used to update the previous network traffic interaction graph to obtain the initial network traffic interaction graph at the current moment.

[0126] In this way, real-time updates can adapt to constantly changing network traffic patterns. Furthermore, sparsification of the initial network traffic interaction graph based on edge importance helps reduce the computational complexity of the graph without affecting detection performance.

[0127] Regarding step S102, the initial node features may refer to the original attribute information of each node, which may include the node's IP address, communication behavior statistics, etc.

[0128] The incoming node characteristics refer to the data characteristics transmitted from neighboring nodes to this node (e.g., traffic, latency, number of data packets, etc. from other nodes).

[0129] The outgoing node characteristics refer to the data characteristics transmitted from this node to other adjacent nodes (e.g., the traffic, latency, number of data packets sent by this node, etc.).

[0130] The node feature update process can be a process of comprehensively adjusting the initial features of the current node by combining the features of adjacent incoming nodes and outgoing nodes in a weighted manner.

[0131] The neighboring nodes of a given node are determined through the following steps: determine each edge containing the given node; determine all other nodes on all edges except the given node as its neighboring nodes. Each node has at least one neighboring node.

[0132] For example, regarding step S102, in one embodiment provided in this application, the node feature update process, based on the initial node features of the node, the incoming node features transmitted from each neighboring node to the node, and the outgoing node features transmitted from the node to each neighboring node, to obtain the comprehensive node features of the node, includes:

[0133] S1021. Aggregate all incoming node features of the node to obtain the aggregated incoming features of the node.

[0134] S1022. Aggregate the features of all outgoing nodes of the node to obtain the aggregated outgoing features of the node.

[0135] S1023. Based on the initial node features, the aggregated incoming features, and the aggregated incoming features of the node, perform node feature update processing to obtain the comprehensive node features of the node.

[0136] For step S1021, the goal of this step is to aggregate the traffic characteristics passed to the node by all its neighboring nodes, thereby obtaining the aggregated incoming characteristics of the node.

[0137] The aggregation methods used may include weighted average, summation aggregation, maximum value aggregation, etc.

[0138] For step S1022, the goal of this step is to aggregate the traffic characteristics received by all neighboring nodes from the node to obtain the aggregated outgoing characteristics of the node.

[0139] For step S1023, for example, the initial node features are combined with the aggregated incoming and outgoing features, and processed by the update function (weighted summation and activation function) to obtain the comprehensive features of the node. This comprehensive feature more comprehensively reflects the node's state and its interaction with its neighbors.

[0140] The specific formulas for steps S1021-S1023 are as follows:

[0141]

[0142] in, The aggregate input feature for the u-th node is... The aggregation outgoing feature of the u-th node, Neighbor in (u) is the set of all neighboring nodes of the input u-th node. out (u) is the set of all neighboring nodes sent out by the u-th node. Let be the initial node characteristics of the u-th node. This represents the updated comprehensive node characteristics of the u-th node.

[0143] For an example, please refer to Figure 2 , Figure 2 This is a schematic diagram illustrating the principle of determining the comprehensive node characteristics of a node, as provided in this application. Figure 2 As shown, when determining the comprehensive node characteristics of node 1, the adjacent nodes of node 1 include node 2, node 3, and node 4. The incoming node characteristics include the incoming node characteristics of node 2, node 3, and node 4, while the outgoing node characteristics only include the outgoing node characteristics from node 1 to node 2. Therefore, the aggregated incoming characteristics are determined based on the incoming node characteristics of node 2, node 3, and node 4, and the aggregated outgoing characteristics are determined only based on the outgoing node characteristics from node 1 to node 2.

[0144] For step S103, for each edge in the initial network traffic interaction graph, the two nodes corresponding to that edge are determined, referred to as the first node and the second node, respectively. For the first node, all incoming edges (first incoming edges) of the first node are determined, and the initial edge features of all first incoming edges are obtained. The initial edge features of the first incoming edges are aggregated to obtain the first aggregated feature. For the second node, all incoming edges (second incoming edges) of the second node are determined, and the initial edge features of all second incoming edges are obtained. The initial edge features of the second incoming edges are aggregated to obtain the second aggregated feature.

[0145] An incoming edge is an edge that points from another node to this node.

[0146] Wherein, the initial edge features of the directed edge e = (u, v) The formula for calculating aggregation features is as follows:

[0147]

[0148] Where ω represents the weight of each edge. For example, when an edge has temporal attributes, the feature representation can be made more comprehensive by refining the weights. Let j be the aggregation feature of the j-th node on this edge. The aggregation feature of the other node i is determined in a similar way to that of j, and will not be described again here.

[0149] For step S104, when performing edge feature update processing, it can be implemented using a multilayer perceptron (MLP).

[0150] For an example, please refer to Figure 3 , Figure 3 This is a schematic diagram illustrating the principle of determining the comprehensive edge characteristics provided in this application. For example... Figure 3 As shown, The initial node characteristics of the first node. for, The initial node characteristics of the second node. This is the first aggregation feature. This is the second aggregation feature. Let the initial edge characteristics be those of the nth edge. Let be the comprehensive edge characteristics of the nth edge.

[0151] Regarding step S105, the anomaly detection model is obtained by training an edge-integrated graph attention network.

[0152] The detection results indicate whether there is abnormal behavior (i.e., abnormal traffic) in the target network. When the detection results indicate abnormal network traffic, the specific abnormality type is also output.

[0153] Examples of exception types could include: reconnaissance attacks, distributed denial-of-service attacks, man-in-the-middle attacks, replay attacks, etc.

[0154] Regarding step S105, in one embodiment provided in this application, the step of inputting the comprehensive node features of all nodes and the comprehensive edge features of all edges into a pre-trained anomaly detection model to determine the detection result of network traffic in the target network includes:

[0155] S1051. Based on the interaction relationship between nodes and edges, the comprehensive node features of each node and the comprehensive edge features of each edge are weighted and updated through the edge attention layer in the anomaly detection model to obtain the output node features of each node and the output edge features of each edge.

[0156] S1052. The output node features of all nodes and the output edge features of all edges are classified through the MLP layer in the anomaly detection model to obtain network category features.

[0157] S1053. The network category features are normalized by the softmax layer in the anomaly detection model, and the detection results of network traffic in the target network are output.

[0158] For step S1051, the features of nodes and edges are updated by weighting based on the interaction relationship between nodes and edges through the edge attention mechanism, thereby extracting the output node features of each node and the output edge features of each edge.

[0159] When performing weighted updates, the edge attention layer may include: for each node, calculating the influence weight of each edge on that node and updating the features of each node; and for each edge, calculating the weight between that edge and the connected nodes, thereby updating the features of each edge.

[0160] The combined node features of all input nodes and the combined edge features of all input edges can typically be represented as node features. Sum of edge features Where N and F n Let M and F represent the number of nodes and the number of node features, respectively. Similarly, let M and F represent the number of nodes and the number of node features, respectively. m These represent the number of edges and the number of edge characteristics, respectively.

[0161] Regarding step S1051, in one embodiment provided in this application, the output node characteristics of each node are determined through the following steps:

[0162] S11. Perform linear transformation on the comprehensive node features of all nodes and the comprehensive node features of all edges to obtain the linear node features of each node and the linear edge features of each edge under the same dimension.

[0163] S12. For each node, determine the node attention coefficient of any adjacent node relative to the node based on the linear node characteristics of the node, the linear node characteristics of any adjacent node corresponding to the node, and the linear edge characteristics of the connecting edge between the two nodes.

[0164] S13. Normalize the node attention coefficients of all neighboring nodes relative to this node to determine the normalized attention weight of any neighboring node relative to this node.

[0165] S14. Perform a weighted update process based on the node normalization attention weights of all neighboring nodes relative to this node, the linear node features of neighboring nodes, and the linear edge features of the edge containing this node, to obtain the output node features of this node.

[0166] For step S11, when performing linear transformation, it can be achieved by multiplying with a weight matrix and adding a bias term.

[0167] For step S12, the formula corresponding to the node attention coefficient is:

[0168]

[0169] Among them, z ij The value of a feature of node j to node i is represented by the node attention coefficient, where W... u W v and W e These are the network coefficients of the anomaly detection model. During model training, W u W v and W e This is a learnable weight matrix.

[0170] For step S13, the formula corresponding to the normalized attention weight of the node is determined as follows:

[0171]

[0172] The unfolded form is as follows:

[0173]

[0174] α ij To normalize the attention weights for nodes, Node i Let be the set of neighboring nodes of node i. These are the network coefficients of the anomaly detection model.

[0175] For step S14, the formula corresponding to the output node features of the node is:

[0176]

[0177] Regarding step S1051, in one embodiment provided in this application, the output edge characteristics of each edge are determined through the following steps:

[0178] S21. For each edge, determine the structural score of the edge based on the out-degree of the source node and the in-degree of the target node.

[0179] S22. Determine the edge attention coefficient based on the structural score of the edge, the linear node characteristics of the source node on the edge, the linear node characteristics of the target node on the edge, and the linear edge characteristics of the edge.

[0180] S23. Obtain the edge sensitivity of the edge, and perform normalization processing based on the edge sensitivity, the edge attention coefficient of the edge, and the edge attention coefficient of the edge where the target node is located, to determine the edge normalized attention weight of the edge.

[0181] S24. Perform a weighted update process based on the edge normalization attention weight and the linear edge features of the edge to obtain the output edge features of the edge.

[0182] For step S21, the formula for calculating the structural score is:

[0183]

[0184] Where, d out (i) and d in (j) represents the out-degree of the source node and the in-degree of the target node of each edge, respectively, and D represents the sum of all degrees in the graph.

[0185] It should be noted that the importance of an edge is not only affected by the characteristics of the corresponding node and the edge, but also often related to the graph structure properties such as the degree of the nodes it connects to. Nodes with high out-degree or high in-degree usually have a more important position in the graph, so the edges connected to these nodes are also given a higher importance score.

[0186] For step S22, the formula for calculating the edge attention coefficient is:

[0187]

[0188] For step S23, the formula for calculating the edge-normalized attention weights is:

[0189]

[0190] Among them, Edge j This represents the set of all edges with target node i. This represents edge sensitivity; further adjustments to the normalized attention weights enhance the model's ability to capture details of the graph structure. β ij This reflects the edge The importance relative to other edges during the entire feature update process (β) ik (This is for normalized attention weights). By combining edge feature information and edge sensitivity scores, this approach not only considers the edge's impact on a single target node but also reflects its position in the feature propagation and update process within the entire graph structure. Therefore, it balances the contributions of node and edge features to the final representation to a certain extent, ensuring that the model not only focuses on the node's own features but also emphasizes the connectivity relationships between edges.

[0191] The edge sensitivity is determined by the following formula:

[0192]

[0193] To describe the edge sensitivity of a graph, an edge sensitivity parameter μ is used to reflect the contribution ratio of node features and edge features. Here, λ represents the contribution ratio of node features and edge features in generating new node features, determined by the dimensions of the node features and edge features. ε in the formula is a very small positive number to avoid a zero denominator. Finally, the interval is mapped to (0,1) to obtain the edge sensitivity S.edge This modifies the edge sensitivity of the entire graph.

[0194]

[0195] It should be noted that the introduction of edge sensitivity can provide weight allocation for the combination of node features and edge features in the subsequent model.

[0196] For step S24, the formula for calculating the output edge features is as follows:

[0197]

[0198] To output edge features, It is a linear edge feature.

[0199] In step S1052, the output features of all nodes and edges are classified using a multilayer perceptron (MLP) layer to obtain network category features. This process maps features to specific category labels, such as normal traffic or abnormal traffic.

[0200] The output of the MLP layer is a probability distribution for each node and edge category, representing the category attribute of each node and edge in the network.

[0201] For step S1053, the network category features are normalized by the Softmax layer so that the sum of the output probabilities of the category features is 1, and the final network traffic detection result is obtained.

[0202] The traffic detection results in the target network are determined through the output of the Softmax layer. The detection results may include two categories: "normal" or "abnormal," or more granular category labels. This application can output more granular category labels.

[0203] Therefore, the anomaly detection model involves multiple neural network modules (side attention mechanism, MLP and Softmax), each of which plays a role in extraction, classification and normalization, and finally outputs the detection result of whether the network traffic is normal.

[0204] Regarding the anomaly detection model described in step S105, in one embodiment provided in this application, the anomaly detection model is determined through the following steps:

[0205] S31. Obtain multiple sample network traffic interaction graphs in multiple experimental network environments, and determine the sample node features and sample edge features of sample nodes and sample edges in each sample network traffic interaction graph; wherein, each sample network traffic interaction graph is labeled with a real label.

[0206] S32. Input the sample node features of all sample nodes and the sample edge features of all sample edges in the sample network traffic interaction graph into the edge ensemble graph attention network in sequence to determine the prediction result of each sample network traffic interaction graph.

[0207] S33. Based on the prediction results and true labels of the network traffic interaction graph for each sample, determine at least one target loss function value;

[0208] S34. The network parameters of the edge-integrated graph attention network are iteratively updated according to the at least one target loss function value and the preset learning rate strategy to obtain the anomaly detection model.

[0209] For step S31, the experimental network is a network traffic simulation environment used to train and validate the model. Its purpose is to generate sample network traffic interaction graphs and provide a dataset containing real labels for use in model training and evaluation.

[0210] The experimental network includes both normal and abnormal traffic scenarios. When abnormal traffic scenarios are included, the corresponding real-world label includes the specific type of abnormality.

[0211] The actual labels can be added to each edge or to the entire network.

[0212] When a real label is added to each edge, the trained anomaly detection model can detect each edge and thus identify the abnormal edges.

[0213] For step S32, the Edge-Integrated Graph Attention Network (EGAT) is used to extract and classify the sample features in the input sample traffic interaction graph, and predict the state of the traffic interaction graph (normal or abnormal, and the type of abnormality).

[0214] For step S33, the difference between the model prediction results and the true labels is evaluated by calculating the loss function, which provides a basis for optimizing the model parameters.

[0215] For step S34, the network parameters include gradually adjusting the key hyperparameters of the neural network, including the learning rate, edge importance weight coefficients, embedding dimension, etc., to find the optimal configuration.

[0216] The update cutoff condition can be that the update ends when the classification evaluation metric requirements are met. Classification evaluation metrics may include accuracy, precision, recall, and F1 score, ensuring the model has high detection performance in different scenarios. Specifically, ROC curves can be plotted and AUC values ​​calculated to further analyze the model's performance at different decision thresholds. By observing the trend of AUC value changes, the overall separation ability of the model in anomaly detection can be determined, providing guidance for optimizing the threshold.

[0217] For example, to simulate a realistic attack scenario under high-density communication as closely as possible, this study built a real industrial control network (ICS) test platform based on existing project experimental conditions, using ICS as the background. The platform's equipment is largely domestically produced, and communication uses the Modbus TCP protocol. The simulation lasted approximately 3 hours. The first hour was free from attacks, while the following two hours saw random and intermittent network attacks. To prevent overlapping attacks, gaps were set between attacks to allow time for system recovery after each attack. Four types of network attacks were implemented on the test platform: reconnaissance, distributed denial-of-service (DDoS), man-in-the-middle (MitM), and replay attacks. When detecting abnormal traffic, traditional methods rely on simple statistical indicators or single-rule screening, leading to frequent false negatives and missed detections, resulting in unstable detection performance and a lack of practicality. Against the above background, the detection method of the present invention is introduced. The first step is to collect communication data during the simulation process and process the data packets using a flow generator. The second step is to preprocess the data stream and construct the corresponding network traffic interaction graph. The third step is to update the node features and edge features using a graph feature representation method. The fourth step is to use the EGAT model for adaptive learning based on the graph features obtained in the third step to identify abnormal edge traffic. The fifth step is to compare various classification evaluation indicators and optimize the model parameters.

[0218] This study compares the detection results of several common graph feature representation methods under different models. The experimental results show that the proposed detection method significantly outperforms traditional methods in anomaly detection in high-frequency communication scenarios, not only improving the accuracy of anomaly detection but also achieving effective deployment in complex communication topologies. The comparison results are shown in Table 1 below: Table 1 compares the anomaly edge detection performance of the proposed method with other methods under different models.

[0219] Table 1:

[0220]

[0221] The research results show that the EGAT-based edge-sensitive graph-based abnormal traffic detection method significantly outperforms traditional methods, and can detect five other types of abnormal attack traffic. This method can be applied not only to network traffic detection in the field of network security, but also to abnormal edge detection in other industries.

[0222] In this way, this application constructs an initial network traffic interaction graph by combining communication endpoint information and traffic interaction information, fully capturing the complex traffic interaction relationships in the network and ensuring the integrity and accuracy of the graph structure. Furthermore, the features of nodes and edges in the graph not only contain their own information but also incorporate their interaction relationships with adjacent nodes or edges, helping to reflect the fine-grained characteristics of network traffic. This scheme uses an edge-integrated graph attention network for training and anomaly detection, which can dynamically adjust the feature aggregation strategy according to the edge weights, making it more sensitive to capturing key traffic interaction relationships and effectively improving the model's ability to identify abnormal patterns.

[0223] In summary, this solution significantly improves the accuracy of network traffic anomaly detection by constructing an initial network traffic interaction graph with edge-sensitive characteristics, performing refined modeling and updating of node and edge features in the graph, and introducing an edge-integrated graph attention network, thus providing strong technical support for anomaly detection in target networks.

[0224] Based on the same inventive concept, this application also provides a detection device corresponding to the detection method. Since the principle of the device in this application is similar to the detection method described above, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0225] Please see Figure 4 , Figure 5 , Figure 4 This is one of the structural schematic diagrams of a network traffic detection device provided in an embodiment of this application. Figure 5 This is a second schematic diagram of a network traffic detection device provided in an embodiment of this application. Figure 4 As shown, the detection device 400 includes:

[0226] The construction module 410 is used to construct an initial network traffic interaction graph with edge sensitivity based on the communication endpoint information and traffic interaction information in the traffic data of the collected target network, and to determine the initial node characteristics of each node and the initial edge characteristics of each edge in the initial network traffic interaction graph.

[0227] The first update module 420 is used to perform node feature update processing on each node in the initial network traffic interaction graph, based on the initial node features of the node, the incoming node features transmitted from each adjacent node to the node, and the outgoing node features transmitted from the node to each adjacent node, to obtain the comprehensive node features of the node.

[0228] The determination module 430 is used to determine the first node and the second node corresponding to each edge in the initial network traffic interaction graph, and to determine the first aggregate feature of all incoming edges of the first node and the second aggregate feature of all incoming edges of the second node.

[0229] The second update module 440 is used to perform edge feature update processing based on the initial edge features of the edge, the initial node features of the first node, the initial node features of the second node, the first aggregation feature, and the second aggregation feature to obtain the comprehensive edge features of the edge.

[0230] The detection module 450 is used to input the comprehensive node features of all nodes and the comprehensive edge features of all edges into a pre-trained anomaly detection model to determine the detection results of network traffic in the target network; wherein, the anomaly detection model is obtained by training an edge-integrated graph attention network.

[0231] Optionally, when constructing an initial network traffic interaction graph with edge-sensitive characteristics based on the communication endpoint information and traffic interaction information in the collected traffic data of the target network, the construction module 410 is used to:

[0232] Traffic data in the target network environment is collected to obtain raw network data packets;

[0233] Perform stream data processing on the original network data packets to determine the target network data stream;

[0234] Based on the communication endpoint information in the target network data stream, at least one node is determined, and based on the traffic interaction information between the communication endpoints in the target network data stream, at least one edge is determined.

[0235] Based on all identified nodes and edges, construct the initial network traffic interaction graph.

[0236] Optionally, when the first update module 420 performs node feature update processing based on the initial node features of the node, the incoming node features transmitted from each neighboring node to the node, and the outgoing node features transmitted from the node to each neighboring node to obtain the comprehensive node features of the node, the first update module 420 is used to:

[0237] Aggregate all incoming node features for this node to obtain the aggregated incoming features for this node;

[0238] Aggregate the features of all outgoing nodes of this node to obtain the aggregated outgoing features of this node.

[0239] Based on the initial node features, the aggregated incoming features, and the aggregated incoming features of the node, node feature update processing is performed to obtain the comprehensive node features of the node.

[0240] Optionally, when the detection module 450 inputs the comprehensive node features of all nodes and the comprehensive edge features of all edges into a pre-trained anomaly detection model to determine the detection result of network traffic in the target network, the detection module 450 is used to:

[0241] Based on the interaction between nodes and edges, the comprehensive node features of each node and the comprehensive edge features of each edge are weighted and updated through the edge attention layer in the anomaly detection model to obtain the output node features of each node and the output edge features of each edge.

[0242] The network category features are obtained by classifying the output node features of all nodes and the output edge features of all edges through the MLP layer in the anomaly detection model.

[0243] The network category features are normalized by the softmax layer in the anomaly detection model, and the detection results of network traffic in the target network are output.

[0244] Optionally, the detection module 450 is further configured to determine the output node characteristics of each node through the following steps:

[0245] A linear transformation is performed on the combined node features of all nodes and the combined node features of all edges to obtain the linear node features of each node and the linear edge features of each edge under the same dimension.

[0246] For each node, the node attention coefficient of any adjacent node relative to the node is determined based on the linear node characteristics of the node, the linear node characteristics of any adjacent node of the node, and the linear edge characteristics of the connecting edge between the two nodes.

[0247] The node attention coefficients of all neighboring nodes relative to this node are normalized to determine the normalized attention weight of any neighboring node relative to this node.

[0248] The output node features of a node are obtained by weighting and updating the node based on the normalized attention weights of all neighboring nodes relative to the node, the linear node features of the neighboring nodes, and the linear edge features of the edge containing the node.

[0249] Optionally, the detection module 450 is further configured to determine the output edge features of each edge through the following steps:

[0250] For each edge, determine the structural score of the edge based on the out-degree of the source node and the in-degree of the target node on that edge;

[0251] The edge attention coefficient is determined based on the structural score of the edge, the linear node features of the source node on the edge, the linear node features of the target node on the edge, and the linear edge features of the edge.

[0252] Obtain the edge sensitivity of the edge, and normalize it based on the edge sensitivity, the edge attention coefficient of the edge, and the edge attention coefficient of the edge containing the target node to determine the edge normalized attention weight of the edge.

[0253] The edge features are obtained by performing a weighted update process based on the edge normalization attention weight and the linear edge features of the edge.

[0254] Optional, such as Figure 5 As shown, the detection device 400 further includes a training module 460, which is used to determine an anomaly detection model through the following steps:

[0255] Multiple sample network traffic interaction graphs were obtained from multiple experimental network environments, and the sample node features and sample edge features of sample nodes and sample edges in each sample network traffic interaction graph were determined; each sample network traffic interaction graph was labeled with a real label.

[0256] The sample node features of all sample nodes and the sample edge features of all sample edges in the sample network traffic interaction graph are sequentially input into the edge ensemble graph attention network to determine the prediction result of each sample network traffic interaction graph.

[0257] Based on the prediction results and true labels of the network traffic interaction graph for each sample, determine at least one target loss function value;

[0258] The network parameters of the edge-integrated graph attention network are iteratively updated based on the at least one target loss function value and the preset learning rate strategy to obtain the anomaly detection model.

[0259] Please see Figure 6 , Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 6As shown, the electronic device 600 includes a processor 610, a memory 620, and a bus 630.

[0260] The memory 620 stores machine-readable instructions executable by the processor 610. When the electronic device 600 is running, the processor 610 and the memory 620 communicate via the bus 630. When the machine-readable instructions are executed by the processor 610, they can perform the operations described above. Figures 1 to 3 The steps in the method embodiment shown are specifically implemented in the method embodiment and will not be repeated here.

[0261] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can perform the above-described actions. Figures 1 to 3 The steps in the method embodiment shown are specifically implemented in the method embodiment and will not be repeated here.

[0262] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0263] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the shown or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0264] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0265] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0266] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0267] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The scope of protection of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for detecting network traffic, characterized in that, The detection method includes: Based on the communication endpoint information and traffic interaction information in the traffic data collected from the target network, an initial network traffic interaction graph with edge sensitivity is constructed, and the initial node characteristics of each node and the initial edge characteristics of each edge in the initial network traffic interaction graph are determined; the initial network traffic interaction graph is a directed multigraph; the edge sensitivity means that the edges in the graph not only reflect the connection relationship between nodes, but also consider the characteristics of traffic interaction, and the edge characteristics are used to describe the interaction information between nodes, including the size of the data packet, the transmission delay, and the interaction frequency; For each node in the initial network traffic interaction graph, node feature update processing is performed based on the node's initial node features, aggregated incoming features, and aggregated outgoing features to obtain the node's comprehensive node features. The aggregated incoming features of the node are determined based on the incoming node features transmitted from each adjacent node to the node, and the aggregated outgoing features of the node are determined based on the outgoing node features transmitted from the node to each adjacent node. For each edge in the initial network traffic interaction graph, determine the first node and the second node corresponding to the edge, and determine the first aggregate feature of all incoming edges of the first node and the second aggregate feature of all incoming edges of the second node; Based on the initial edge features, the initial node features of the first node, the initial node features of the second node, the first aggregate feature, and the second aggregate feature, edge feature update processing is performed to obtain the comprehensive edge features of the edge. The combined node features of all nodes and the combined edge features of all edges are input into a pre-trained anomaly detection model to determine the detection results of network traffic in the target network; wherein, the anomaly detection model is obtained by training an edge-integrated graph attention network.

2. The detection method according to claim 1, characterized in that, The step of constructing an initial network traffic interaction graph with edge-sensitive characteristics based on the communication endpoint information and traffic interaction information in the collected traffic data of the target network includes: Traffic data in the target network environment is collected to obtain raw network data packets; Perform stream data processing on the original network data packets to determine the target network data stream; Based on the communication endpoint information in the target network data stream, at least one node is determined, and based on the traffic interaction information between the communication endpoints in the target network data stream, at least one edge is determined. Based on all identified nodes and edges, construct the initial network traffic interaction graph.

3. The method of claim 1, wherein The comprehensive node characteristics of this node are determined through the following steps: Aggregate all incoming node features for this node to obtain the aggregated incoming features for this node; Aggregate the features of all outgoing nodes of this node to obtain the aggregated outgoing features of this node. Based on the initial node characteristics, the aggregated incoming characteristics, and the aggregated outgoing characteristics of the node, node characteristic update processing is performed to obtain the comprehensive node characteristics of the node.

4. The method of claim 1, wherein, The step of inputting the comprehensive node features of all nodes and the comprehensive edge features of all edges into a pre-trained anomaly detection model to determine the detection results of network traffic in the target network includes: Based on the interaction between nodes and edges, the comprehensive node features of each node and the comprehensive edge features of each edge are weighted and updated through the edge attention layer in the anomaly detection model to obtain the output node features of each node and the output edge features of each edge. The network category features are obtained by classifying the output node features of all nodes and the output edge features of all edges through the MLP layer in the anomaly detection model. The network category features are normalized by the softmax layer in the anomaly detection model, and the detection results of network traffic in the target network are output.

5. The detection method according to claim 4, characterized in that, The output node characteristics of each node are determined through the following steps: A linear transformation is performed on the combined node features of all nodes and the combined node features of all edges to obtain the linear node features of each node and the linear edge features of each edge under the same dimension. For each node, the node attention coefficient of any adjacent node relative to the node is determined based on the linear node characteristics of the node, the linear node characteristics of any adjacent node of the node, and the linear edge characteristics of the connecting edge between the two nodes. The node attention coefficients of all neighboring nodes relative to this node are normalized to determine the normalized attention weight of any neighboring node relative to this node. The output node features of a node are obtained by performing a weighted update process based on the node normalized attention weights of all neighboring nodes relative to the node, the linear node features of the neighboring nodes, and the linear edge features of the edge containing the node.

6. The detection method according to claim 5, characterized in that, The output edge features of each edge are determined through the following steps: For each edge, determine the structural score of the edge based on the out-degree of the source node and the in-degree of the target node on that edge; The edge attention coefficient is determined based on the structural score of the edge, the linear node features of the source node on the edge, the linear node features of the target node on the edge, and the linear edge features of the edge. Obtain the edge sensitivity of the edge, and normalize it based on the edge sensitivity, the edge attention coefficient of the edge, and the edge attention coefficient of the edge containing the target node to determine the edge normalized attention weight of the edge. The edge features are obtained by performing a weighted update process based on the edge normalization attention weight and the linear edge features of the edge.

7. The method of claim 1, wherein, The anomaly detection model is determined through the following steps: Multiple sample network traffic interaction graphs were obtained from multiple experimental network environments, and the sample node features and sample edge features of sample nodes and sample edges in each sample network traffic interaction graph were determined; each sample network traffic interaction graph was labeled with a real label. The sample node features of all sample nodes and the sample edge features of all sample edges in the sample network traffic interaction graph are sequentially input into the edge ensemble graph attention network to determine the prediction result of each sample network traffic interaction graph. Based on the prediction results and true labels of the network traffic interaction graph for each sample, determine at least one target loss function value; The network parameters of the edge-integrated graph attention network are iteratively updated based on the at least one target loss function value and the preset learning rate strategy to obtain the anomaly detection model.

8. A network traffic detection apparatus, characterized by, The detection device includes: The construction module is used to construct an initial network traffic interaction graph with edge sensitivity based on the communication endpoint information and traffic interaction information in the traffic data collected from the target network, and to determine the initial node characteristics of each node and the initial edge characteristics of each edge in the initial network traffic interaction graph; the initial network traffic interaction graph is a directed multigraph; the edge sensitivity means that the edges in the graph not only reflect the connection relationship between nodes, but also consider the characteristics of traffic interaction, and the edge characteristics are used to describe the interaction information between nodes, including the size of the data packet, the transmission delay, and the interaction frequency; The first update module is used to perform node feature update processing on each node in the initial network traffic interaction graph, based on the node's initial node features, the node's aggregated incoming features, and the node's aggregated outgoing features, to obtain the node's comprehensive node features; wherein, the node's aggregated incoming features are determined based on the incoming node features transmitted from each adjacent node to the node, and the node's aggregated outgoing features are determined based on the outgoing node features transmitted from the node to each adjacent node. The determination module is used to determine the first node and the second node corresponding to each edge in the initial network traffic interaction graph, and to determine the first aggregate feature of all incoming edges of the first node and the second aggregate feature of all incoming edges of the second node. The second update module is used to perform edge feature update processing based on the initial edge features of the edge, the initial node features of the first node, the initial node features of the second node, the first aggregation feature, and the second aggregation feature to obtain the comprehensive edge features of the edge. The detection module is used to input the comprehensive node features of all nodes and the comprehensive edge features of all edges into a pre-trained anomaly detection model to determine the detection results of network traffic in the target network; wherein, the anomaly detection model is obtained by training an edge-integrated graph attention network.

9. An electronic device, comprising: include: The device includes a processor, a memory, and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the memory via the bus, and the machine-readable instructions are executed by the processor to perform the steps of the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the method as described in any one of claims 1 to 7.

Images