Botnet traffic detection method and system based on feature selection and time sequence features

Abstract

The invention belongs to the field of network security, and provides a Botnet traffic detection method and system based on feature selection and time sequence features, and the method comprises the steps: obtaining original network traffic data, and carrying out the preprocessing; performing feature selection on the preprocessed network traffic to obtain key network traffic; according to the key network traffic, utilizing the trained double-layer long-short-term time sequence diagram attention network model to carry out botnet detection, constructing a host feature vector by key features in the key network traffic, and carrying out diagram node embedding by taking the host feature vector and time features as node features; enhancing the time characteristic of each node; the neighbor node features of the node to be detected are aggregated and fused into the feature representation of the host node to obtain target time sequence features; and classifying the target time sequence features to obtain a botnet detection result. The method can automatically learn features and capture traffic time sequence features and spatial features, and has high-efficiency botnet detection.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a method and system for detecting botnet traffic based on feature selection and time series features. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] Botnets are one of the major security threats facing the Internet today. Attackers form botnets by controlling a large number of infected hosts (zombie hosts) and use these controlled hosts to launch distributed denial of service attacks (DDoS), spam propagation, information theft and other malicious behaviors. Timely and accurate detection of botnet traffic is of great significance to maintaining network security.

[0004] Traditional botnet detection methods are mainly based on rules or signatures, relying on manually defined features or known botnet traffic patterns. These methods have some inherent defects, such as the inability to detect new botnets in a timely manner and the inability to detect unknown botnets. With the continuous development of machine learning technology, botnet detection methods based on machine learning have received widespread attention. However, these traditional machine learning methods rely on manually designed features and have difficulty capturing complex patterns in high-dimensional traffic data. In recent years, anomaly detection methods based on deep learning have shown better prospects. Long short-term memory neural network algorithms, Transformers, convolutional neural networks, and graph convolutional neural networks have achieved results in the field of botnet detection. Although these deep learning methods have improved detection performance to a certain extent, most of them still do not fully consider the temporal nature of network traffic and network topology information.

[0005] In summary, the current botnet detection methods have the following problems: static features are difficult to characterize the dynamic evolution process of botnets; the number of features is huge, the computational overhead is high, and the detection efficiency is low; it is difficult to effectively identify the correlation between the timing and spatial topology of botnet communications. Summary of the invention

[0006] In order to solve the above problems, the present invention proposes a botnet traffic detection method and system based on feature selection and timing features. The present invention uses the CICFlowMeter tool to extract statistical features from the original network traffic, and automatically selects key features based on the Boruta-Shap algorithm. While reducing the computational complexity, the marginal contribution of each feature to the model prediction result can be calculated to help explain the importance of each feature to the final prediction; an improved timing graph attention network is introduced, and on the basis of the original time coding of TGAT, a double-layer LSTM structure is designed to enhance the time feature extraction capability, and effectively model the dynamic interaction relationship between nodes; the detection accuracy is high and it has strong generalization ability.

[0007] According to some embodiments, a first solution of the present invention provides a method for detecting botnet traffic based on feature selection and time series features, using the following technical solutions: Botnet traffic detection method based on feature selection and time series features, including: Obtaining original network traffic data and performing preprocessing to obtain preprocessed network traffic; Perform feature selection on the preprocessed network traffic to obtain key network traffic; According to the key network traffic, the trained two-layer long-short term temporal graph attention network model is used to detect botnets. Specifically: Build a network traffic relationship graph based on key network traffic; The time characteristics of each node are enhanced by using a two-layer long short-term memory network time coding model; The target time series features are obtained by aggregating the neighbor node features of the node to be detected and fusing them into the feature representation of the host node; Classify the target time series features and obtain the botnet detection results.

[0008] Furthermore, the feature selection is performed on the pre-processed network traffic to obtain key network traffic, specifically: Creating a corresponding shadow feature for each statistical feature in the preprocessed network traffic, and splicing each statistical feature with its corresponding shadow feature to obtain spliced ​​network traffic; The machine learning model is trained based on the spliced ​​network traffic, and the SHAP value of each statistical feature and the SHAP value of each shadow feature in the preprocessed network traffic are calculated using the trained machine learning model; The highest SHAP value among all shadow features is used as the threshold. If the SHAP value of the statistical feature is higher than the threshold, it is a key feature. The above process is iterated until the preset maximum number of iterations is reached to obtain the key network traffic.

[0009] Furthermore, the network traffic relationship diagram is constructed according to the key network traffic, specifically: Using each host in the key network traffic as a node and the communication relationship between hosts as an edge, an initial network traffic relationship graph is constructed; The sliding time window method is used to divide the key network traffic and obtain multiple time windows of fixed length; Traverse all network traffic in each time window and build a node set based on the source IP address and destination IP address; The key features in the key network traffic are used to construct the host feature vector, and the host feature vector and time features are used as node features to embed the graph nodes to obtain the final network traffic relationship graph.

[0010] Furthermore, the host feature vector is constructed from the key features in the key network traffic, and the host feature vector and the time feature are used as node features for graph node embedding to obtain the final network traffic relationship graph, which is specifically: The key features in the key network traffic are used to construct the host feature vector and embed it into the node to obtain the node triple, namely the source IP address, the destination IP address and the host feature vector; Convert the triples of all nodes into an undirected graph to obtain the final network traffic relationship graph; The final network traffic relationship graph includes a node set, an edge set and a node feature matrix, wherein each row vector of the node feature matrix corresponds to a host feature vector of a host.

[0011] Furthermore, the two-layer long short-term temporal graph attention network model is composed of a two-layer long short-term memory network module, a four-layer temporal graph attention network module and a fully connected layer: Wherein, the two-layer long short-term memory network module is used to encode and enhance the temporal characteristics of the nodes; The four-layer time-series graph attention network module is used to aggregate the features of the neighboring nodes of the to-be-detected node and fuse them to the to-be-detected node using a multi-head attention mechanism, thereby capturing the importance relationship between the nodes; The fully connected layer is used to classify the output of the four-layer time series graph attention network module to obtain the botnet detection result.

[0012] Furthermore, in the two-layer long short-term memory network module, the first layer is a bidirectional long short-term memory network structure, and the second layer is a unidirectional long short-term memory network structure.

[0013] According to some embodiments, a second solution of the present invention provides a botnet traffic detection system based on feature selection and time series features, which adopts the following technical solutions: Botnet traffic detection system based on feature selection and time series features, including: The network traffic processing module is configured to obtain the original network traffic data and perform preprocessing to obtain the preprocessed network traffic; A feature selection module is configured to perform feature selection on the preprocessed network traffic to obtain key network traffic; The botnet detection module is configured to perform botnet detection based on key network traffic using a trained two-layer long-short term temporal graph attention network model. Specifically: Build a network traffic relationship graph based on key network traffic; The time characteristics of each node are enhanced by using a two-layer long short-term memory network time coding model; The target time series features are obtained by aggregating the neighbor node features of the node to be detected and fusing them into the feature representation of the host node; Classify the target time series features and obtain the botnet detection results.

[0014] According to some embodiments, a third aspect of the present invention provides a computer-readable storage medium.

[0015] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the botnet traffic detection method based on feature selection and time series features as described in the first aspect above.

[0016] According to some embodiments, a fourth aspect of the present invention provides a computer device.

[0017] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps in the method for detecting botnet traffic based on feature selection and timing features as described in the first aspect above are implemented.

[0018] According to some embodiments, a fifth aspect of the present invention provides a computer program product or a computer program.

[0019] The present invention provides a computer program product or a computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the steps in the botnet traffic detection method based on feature selection and time series features as described in the first aspect above.

[0020] Compared with the prior art, the present invention has the following beneficial effects: The present invention first uses the Boruta-Shap algorithm to screen the traffic features, then improves the time series graph attention network (TGAT), and constructs a double-layer long-short-term time series graph attention network model for botnet detection. The CICFlowMeter tool is used to extract statistical features from the original network traffic, and the key features that can more effectively reflect the feature of the botnet traffic are automatically screened out based on the Boruta-Shap algorithm, the detection accuracy of the model is improved, and the computational complexity is reduced; the improved time series graph attention network-double-layer long-short-term time series graph attention network model is introduced, and on the basis of the original time coding of TGAT, a double-layer LSTM structure is designed to enhance the time feature extraction ability, and the dynamic interaction relationship between the modeling nodes is effectively modeled. The present invention realizes the advantages of automated feature selection, efficient model training, high detection accuracy, strong generalization ability, interpretability and maintainability, etc., and is an efficient, reliable and universal botnet detection method that can effectively cope with the ever-changing botnet threats and provide a strong guarantee for network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0022] Figure 1 It is a flow chart of a method for detecting botnet traffic based on feature selection and time series features in an embodiment of the present invention; Figure 2 is a flow chart of the Boruta-Shap feature selection algorithm in an embodiment of the present invention; Figure 3 is a two-layer TGAT information aggregation flow chart in an embodiment of the present invention; Figure 4 It is a flow chart of feature learning of a double-layer long-short term temporal graph attention network model in an embodiment of the present invention; Figure 5 It is a structural diagram of a double-layer long short-term memory network module in an embodiment of the present invention. DETAILED DESCRIPTION

[0023] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0024] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0025] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0026] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0027] Embodiment 1 like Figure 1 As shown, this embodiment provides a method for detecting botnet traffic based on feature selection and timing features. This embodiment uses the method applied to a server as an example. It is understandable that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network servers, cloud communications, middleware services, domain name services, security services CDN, and big data and artificial intelligence platforms. The terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited to this. The terminal and the server can be directly or indirectly connected via wired or wireless communication, which is not limited in this application. In this embodiment, the method includes the following steps: Obtaining original network traffic data and performing preprocessing to obtain preprocessed network traffic; Perform feature selection on the preprocessed network traffic to obtain key network traffic; According to the key network traffic, the trained two-layer long-short term temporal graph attention network model is used to detect botnets. Specifically: Build a network traffic relationship graph based on key network traffic; The time characteristics of each node are enhanced by using a two-layer long short-term memory network time coding model; The target time series features are obtained by aggregating the neighbor node features of the node to be detected and fusing them into the feature representation of the host node; Classify the target time series features and obtain the botnet detection results.

[0028] like Figure 1 As shown, the solution described in this embodiment specifically includes the following steps: Data preprocessing First, collect network flow data, and then collect statistical features of network flow data. In the specific example, use CICFlowMeter tool to automatically extract 83 statistical features from the original network flow data, including basic features (such as source / destination IP, port, etc.), content features (such as payload size, etc.) and time features (such as flow start / end time, etc.). It can be understood that the specific feature extraction tool and the number of features can be adjusted according to actual needs.

[0029] Then, the extracted statistical feature data is preprocessed, that is, data cleaning, by eliminating outliers (such as unreasonable packet size or protocol type), using the mean to fill missing values, and deleting duplicate traffic records to ensure data integrity and consistency. The data is then standardized, including normalizing numerical features to the [0, 1] interval to eliminate feature scale differences, and performing logarithmic transformation on features with large distribution skewness to reduce the impact of skewed distribution on model training, thereby improving data quality and model performance, and finally obtaining preprocessed network traffic.

[0030] Filter out key features based on Boruta-Shap algorithm The Boruta-Shap algorithm is a feature selection algorithm that combines the Boruta feature selection algorithm with the SHAP (Shapley value) method. This combination outperforms the original permutation importance method in terms of speed and the quality of the generated feature subsets. This algorithm not only provides a more accurate and consistent global feature ranking, but also quantifies the specific contribution of each feature to model prediction, providing an intuitive way to understand model decisions. It can be effectively applied to feature extraction tasks in botnet traffic detection. A botnet is a form of network attack that controls a group of infected devices through malicious programs. The core of its detection lies in extracting key features from network traffic data that can distinguish between normal traffic and botnet traffic. The Boruta-Shap feature selection algorithm flow chart is shown below. Figure 2 As shown, the algorithm is as follows: (1) In the feature selection process, firstly, a corresponding shadow feature is created for each statistical feature in the original feature-preprocessed network traffic, and the shadow feature is spliced ​​with the corresponding statistical feature to obtain the spliced ​​feature, and finally the spliced ​​network traffic is obtained; these shadow features are generated by randomly scrambling the values ​​of the statistical features in the preprocessed network traffic, thus retaining the statistical distribution characteristics of the original data, but destroying the association with the target variable. It can be understood that the original feature is each statistical feature in the preprocessed network traffic.

[0031] (2) After obtaining the concatenated network traffic, the machine learning model XGBoost is used for training, and the trained machine learning model is used to calculate the SHAP value of the preprocessed statistical features and the SHAP value of each shadow feature. The SHAP value is based on the concept of Shapley value in game theory, which can accurately measure the contribution of each feature to the model prediction while considering the interaction between features. It should be noted that the machine learning model here includes but is not limited to XGBoost, and other appropriate models can be selected for processing.

[0032] (3) The highest SHAP value among all shadow features is used as the threshold.

[0033] (4) In each iteration, the SHAP value of the original feature is compared with the highest SHAP value among all shadow features. If the importance of the original feature is higher than this threshold, it is marked as an important feature; if it is lower than the threshold, it is marked as an unimportant feature.

[0034] (5) This process will be repeated to check whether all features have been assigned importance until the preset maximum number of iterations is reached or the results tend to be stable, and the key network flow is obtained, where the key network flow includes the key features of each preprocessed statistical feature. Throughout the process, the algorithm uses multiple iterations to ensure the stability of the results. Only features that perform better than shadow features in multiple consecutive iterations will be finally confirmed as important features.

[0035] Boruta-Shap has significant advantages in the botnet traffic detection scenario. By combining the interpretability of SHAP values ​​with Boruta's random screening mechanism, the algorithm can generate high-quality feature subsets, thereby improving the detection accuracy and stability of the classification model. At the same time, the global feature ranking results provided by the algorithm can also help security analysts understand which features are most critical for detecting botnets, such as traffic statistics features (such as traffic size, interval time), protocol features (such as TCP / UDP identifiers) or behavioral features (such as connection frequency). This interpretability not only helps to improve the transparency of the detection model, but also provides a basis for subsequent security policy formulation.

[0036] Temporal Graph Attention Network (TGAT) is a neural network model for learning dynamic graph inductive representations. It can effectively capture the temporal features in dynamic graphs and generate node embeddings that are valid for both unseen nodes and future time points. The embedding of nodes in the graph by TGAT not only reflects the topological structure but also contains temporal information. At the same time, it combines the attention mechanism to effectively aggregate the neighbor features of the temporal topological structure, thereby learning node representations that contain certain time coding information. Taking the two-layer TGAT as an example, the information aggregation method is as follows: Figure 3 shown.

[0037] This embodiment is based on a two-layer long short-term memory network (LSTM) time coding model and a time sequence graph attention network (TGAT) equipped with a fully connected network (FC) to obtain the final two-layer long short-term time sequence graph attention network model (LSTM-TGAT model). This model uses a four-layer TGAT to learn the features of the botnet nodes, and after the features are obtained, they are passed to the fully connected layer for botnet node classification. The feature learning process of the two-layer long short-term time sequence graph attention network model is as follows: Figure 4 As shown, the model training process: First, network traffic data needs to be collected, which can be done using traffic capture tools (such as Wireshark) or network traffic monitoring systems. Then, the CICFlowMeter tool is used to extract 83 statistical features from traffic packets, including basic features (such as source / destination IP addresses, port numbers, protocol types, etc.), content features (such as payload size, number of packets, etc.), and time features (such as flow start / end time, duration, etc.). These features can comprehensively describe the characteristics of network traffic and provide important information for subsequent botnet traffic detection. Next, the data is cleaned to remove invalid data, outliers, and redundant information, such as discarded error packets, duplicate packets, and network noise, to ensure the accuracy and reliability of the data. Subsequently, the Boruta-Shap algorithm is used to screen the statistical features in the preprocessed network traffic, automatically select the key features that are crucial to botnet traffic detection, and quantify the specific contribution of each feature to the model prediction based on the SHAP value, thereby reducing the computational complexity, improving the model efficiency and detection accuracy, and providing an intuitive way to understand the model decision and obtain the key network traffic. Next, the key network traffic is divided into time windows of fixed length, each window corresponding to a graph snapshot. Finally, the preprocessed network traffic data is converted into a graph structure, where nodes represent hosts, edges represent communication relationships between hosts, and node features contain key features selected by Boruta-Shap. This graph structure can effectively capture the dynamic evolution of network traffic and provide a basis for subsequent TGAT model training.

[0038] The specific process is as follows: (1) Time window: In order to handle the time evolution characteristics, a sliding time window method is adopted: a fixed-size time window of 5 minutes is set, and each sliding time interval is 1 minute. A static graph snapshot is constructed in each time window, thus forming a series of timestamped graph snapshot sequences, reflecting the dynamic changes in network communication. Newly appeared IPs will be dynamically added as new nodes, while disappeared communication relationships will no longer appear in new time windows. This method can not only capture the instantaneous state of network communication, but also reflect its changing trend over time, thereby providing a rich information basis for subsequent analysis. In other words, the sliding time window method is used in this embodiment to divide the key network traffic into multiple fixed-length time windows, and traverse each time window. , take all flow records in the current window, and build a node set based on the source IP and destination IP .

[0039] (2) Constructing a relationship graph: Constructing a host feature vector using the key features selected by the Boruta-Shap algorithm , that is, the key features of each host are combined into a host feature vector; then the preprocessed network traffic is represented as a list of triples .in, and are the source IP address and destination IP address of the communication host in the window respectively. In order to capture the communication structure information in the network traffic data, the triple list Convert to undirected ,in is a collection of nodes, is a set of edges, each node Corresponding to a host IP address, is the node feature matrix, each row vector corresponds to the feature vector of a host .

[0040] Specifically, if the host With host If there is communication, then in the figure Add an undirected edge to Through this transformation, network traffic is naturally represented as a graph structure, with different nodes connected by edges and each node having an independent feature vector.

[0041] (3) Select neighbor nodes: Select the destination IP address that communicates with the target node (i.e., the host to be detected) as the neighbor node. These neighbor nodes are the most recent traffic records of the target node. Each neighbor node also has its own neighbor nodes, which are other hosts that communicate with the neighbor node. The time of these neighbor nodes is earlier than or equal to that of the neighbor node, forming a hierarchical relationship structure. This structure can capture the dynamic evolution of network traffic and help the model better understand the behavior pattern of the target node.

[0042] (4) Edge connection: The target node and its neighbor nodes are connected by edges, indicating the communication relationship between them. In the process of graph construction, the edge features are not involved in the calculation and are only used to represent the relationship between nodes.

[0043] (5) Time feature encoding: Each node adds its own time features (such as flow start / end time, duration), and encodes the time difference calculated by the time features of neighboring nodes and the target node. The time difference between the target node and itself is 0. The initial feature of the node is a fusion of its own information (i.e., the key features selected by Boruta-Shap) and time information.

[0044] (6) Temporal coding enhancement: After completing temporal feature coding, the present invention designs a double-layer LSTM structure to enhance temporal feature extraction, such as Figure 5 As shown in the figure, the first layer is a bidirectional LSTM with an input dimension of 64 (the original temporal feature encoding dimension) and a hidden layer dimension of 64. The second layer is a unidirectional LSTM with a hidden layer dimension of 128 and is mapped back to 64 through a fully connected layer.

[0045] (7) Network structure optimization: For the Layer TGAT, introducing residual connection and LayerNorm.

[0046]

[0047] in, represents the current time step, Indicates the number of TGAT layers, Representation Node Feature representation. Representative LayerNorm helps stabilize training and accelerate convergence.

[0048] In addition to the regular residual connections between adjacent layers, cross-layer residuals are added:

[0049] Cross-layer connections allow the network to utilize underlying features more effectively.

[0050] In the In the layer residual block, Dropout (probability ) to alleviate overfitting.

[0051] (8) Aggregation of neighbor information: Through the information aggregation process of 4 layers of TGAT, the present invention extracts the features of neighbor nodes layer by layer and fuses them into the feature representation of the target node. By stacking 4 TGAT layers, the network is able to inductively learn node embeddings and infer the embeddings of new or observed nodes, even if the graph structure evolves over time. This capability enables the model to adapt to dynamic changes in network traffic and effectively detect emerging botnets.

[0052] At the same time, the TGAT module uses a self-attention mechanism to aggregate the features of neighbor nodes, and the number of multi-heads is set to 8. In each layer of TGAT, each node uses a multi-head attention mechanism to aggregate information. The target node is used as a query vector, and the neighbor node is used as an information storage (Key-Value). The multi-head attention mechanism can effectively capture the importance relationship between nodes and help the model better understand the behavior pattern of the target node. By stacking 4 layers of TGAT modules, the model can extract the features of neighbor nodes layer by layer and fuse them into the feature representation of the target node, and finally obtain the temporal feature representation of the target node.

[0053] (9) Classification process: The target node feature representation output by the TGAT module is input into the fully connected network for classification. The fully connected network consists of two fully connected layers. The first layer uses the Relu function for activation to increase the nonlinear ability of the network; the second layer uses the Softmax activation function for binary classification and outputs the detection result of whether it is botnet traffic.

[0054] (10) Loss function and optimization: Use the cross entropy loss function and update the network parameters through the back propagation algorithm to make the network output as close to the target true value as possible and improve the detection accuracy.

[0055] During the model training process, the present invention sets the learning rate to 0.0001, the batch_size to 50, and plans to conduct 100 rounds of training. The cross entropy loss function is used to evaluate the difference between the model prediction result and the true label, and the network parameters are updated through the back propagation algorithm to make the output of the model as close to the target true value as possible, thereby improving the accuracy of detection. In each round of training, the model calculates the loss based on the data of the current batch and adjusts the network weights through the gradient descent optimizer. By continuously adjusting the network parameters and optimizing the model structure, we hope to train a model that can effectively detect botnet traffic after 100 rounds of training.

[0056] Model evaluation indicators,In order to comprehensively evaluate the performance of the model, this paper uses accuracy, recall, F1 value and AUC as indicators.,Accuracy reflects the accuracy of the model prediction, recall reflects the model's ability to identify botnet traffic, F1 value comprehensively considers accuracy and recall, and AUC reflects the performance of the model under different thresholds.

[0057] The model of this embodiment can be applied to a variety of network security scenarios, such as network intrusion detection, network security monitoring, malware analysis, and network security risk assessment. For example, the model can be integrated into a network intrusion detection system to achieve real-time detection and early warning of botnet traffic; it can also be applied to a network security monitoring system to perform real-time analysis and anomaly detection on network traffic; it can also be used for malware analysis to identify the network behavior of malware; finally, it can also be used for network security risk assessment to evaluate the security of the network and formulate corresponding security policies.

[0058] Embodiment 2 This embodiment provides a botnet traffic detection system based on feature selection and time series features, including: The network traffic processing module is configured to obtain the original network traffic data and perform preprocessing to obtain the preprocessed network traffic; A feature selection module is configured to perform feature selection on the preprocessed network traffic to obtain key network traffic; The botnet detection module is configured to perform botnet detection based on key network traffic using a trained two-layer long-short term temporal graph attention network model. Specifically: Build a network traffic relationship graph based on key network traffic; The time characteristics of each node are enhanced by using a two-layer long short-term memory network time coding model; The target time series features are obtained by aggregating the neighbor node features of the node to be detected and fusing them into the feature representation of the host node; Classify the target time series features and obtain the botnet detection results.

[0059] The examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the contents disclosed in the above embodiment 1. It should be noted that the above modules as part of the system can be executed in a computer system such as a set of computer executable instructions.

[0060] The description of each embodiment in the above embodiments has different emphases. For parts not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0061] The proposed system can be implemented in other ways. For example, the system embodiment described above is only illustrative, and the division of the modules is only a logical function division. In actual implementation, there may be other division methods, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed.

[0062] Embodiment 3 This embodiment provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps in the botnet traffic detection method based on feature selection and time series features as described in the first embodiment above are implemented.

[0063] Embodiment 4 This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps in the method for detecting botnet traffic based on feature selection and timing features as described in the first embodiment are implemented.

[0064] Embodiment 5 This embodiment provides a computer program product or a computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the steps of the botnet traffic detection method based on feature selection and time series features described in the first embodiment.

[0065] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program code.

[0066] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0067] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0068] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0069] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0070] Although the above describes the specific implementation mode of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without creative work are still within the scope of protection of the present invention.

Claims

1. A botnet traffic detection method based on feature selection and time series features, characterized in that: include: Obtaining original network traffic data and performing preprocessing to obtain preprocessed network traffic; Perform feature selection on the preprocessed network traffic to obtain key network traffic; According to the key network traffic, the trained two-layer long-short term temporal graph attention network model is used to detect botnets. Specifically: Build a network traffic relationship graph based on key network traffic; The time characteristics of each node are enhanced by using a two-layer long short-term memory network time coding model; The target time series features are obtained by aggregating the neighbor node features of the node to be detected and fusing them into the feature representation of the host node; Classify the target time series features and obtain the botnet detection results.

2. The method for detecting botnet traffic based on feature selection and time series features as claimed in claim 1, characterized in that: The feature selection is performed on the pre-processed network traffic to obtain the key network traffic, which is specifically: Creating a corresponding shadow feature for each statistical feature in the preprocessed network traffic, and splicing each statistical feature with its corresponding shadow feature to obtain spliced ​​network traffic; The machine learning model is trained based on the spliced ​​network traffic, and the SHAP value of each statistical feature and the SHAP value of each shadow feature in the preprocessed network traffic are calculated using the trained machine learning model; The highest SHAP value among all shadow features is used as the threshold. If the SHAP value of the statistical feature is higher than the threshold, it is a key feature. The above process is iterated until the preset maximum number of iterations is reached to obtain the key network traffic.

3. The method for detecting botnet traffic based on feature selection and time series features as claimed in claim 1, characterized in that: The network traffic relationship diagram is constructed according to the key network traffic, specifically: Using each host in the key network traffic as a node and the communication relationship between hosts as an edge, an initial network traffic relationship graph is constructed; The sliding time window method is used to divide the key network traffic and obtain multiple time windows of fixed length; Traverse all network traffic in each time window and build a node set based on the source IP address and destination IP address; The key features in the key network traffic are used to construct the host feature vector, and the host feature vector and time features are used as node features to embed the graph nodes to obtain the final network traffic relationship graph.

4. The method for detecting botnet traffic based on feature selection and time series features as claimed in claim 1, characterized in that: The host feature vector is constructed by using the key features in the key network traffic, and the host feature vector and the time feature are used as node features to embed the graph node to obtain the final network traffic relationship graph, which is specifically: The key features in the key network traffic are used to construct the host feature vector and embed it into the node to obtain the node triple, namely the source IP address, the destination IP address and the host feature vector; Convert the triples of all nodes into an undirected graph to obtain the final network traffic relationship graph; The final network traffic relationship graph includes a node set, an edge set and a node feature matrix, wherein each row vector of the node feature matrix corresponds to a host feature vector of a host.

5. The method for detecting botnet traffic based on feature selection and time series features as claimed in claim 1, characterized in that: The double-layer long short-term temporal graph attention network model is composed of a double-layer long short-term memory network module, a four-layer temporal graph attention network module and a fully connected layer composition: Wherein, the two-layer long short-term memory network module is used to encode and enhance the temporal characteristics of the nodes; The four-layer time-series graph attention network module is used to aggregate and fuse the features of neighbor nodes of the to-be-detected node onto the to-be-detected node using a multi-head attention mechanism, thereby capturing the importance relationship between nodes. The fully connected layer is used to classify the output of the four-layer time series graph attention network module to obtain the botnet detection result.

6. The method for detecting botnet traffic based on feature selection and time series features as claimed in claim 5, characterized in that: The first layer of the two-layer long short-term memory network module is a bidirectional long short-term memory network structure, and the second layer is a unidirectional long short-term memory network structure.

7. A botnet traffic detection system based on feature selection and time series features, characterized in that: include: The network traffic processing module is configured to obtain the original network traffic data and perform preprocessing to obtain the preprocessed network traffic; A feature selection module is configured to perform feature selection on the preprocessed network traffic to obtain key network traffic; The botnet detection module is configured to perform botnet detection based on key network traffic using a trained two-layer long-short term temporal graph attention network model. Specifically: Build a network traffic relationship graph based on key network traffic; The time characteristics of each node are enhanced by using a two-layer long short-term memory network time coding model; The target time series features are obtained by aggregating the neighbor node features of the node to be detected and fusing them into the feature representation of the host node; Classify the target time series features and obtain the botnet detection results.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps in the botnet traffic detection method based on feature selection and timing features as described in any one of claims 1 to 6 are implemented.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps in the botnet traffic detection method based on feature selection and timing features as described in any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps in the method for detecting botnet traffic based on feature selection and timing features as claimed in any one of claims 1 to 6 are implemented.

Images