Lightweight network attack traffic detection method and system based on graph neural network

Abstract

The invention provides a lightweight network attack traffic detection method and system based on a graph neural network, and the method comprises the steps: obtaining to-be-detected network traffic, and constructing a traffic relation graph with an IP address and a port number of the network traffic as nodes and the network traffic as edges; extracting multi-dimensional features from network traffic, performing standardization processing, and constructing edge feature vectors; and inputting the traffic relation graph and the edge feature vector into a GraphSAGE detection model obtained by pre-training, aggregating information of nodes and edges through a message passing mechanism, and generating a classification result of the network traffic to be detected. The detection method provided by the invention can realize high-precision network attack traffic detection, and is suitable for real-time detection and resource-constrained environments.

Description

Technical Field

[0001] The present invention relates to the technical field of network attack traffic detection, and in particular to a lightweight network attack traffic detection method and system based on graph neural network. Background Art

[0002] Network attack traffic detection is a critical task in the field of network security, which aims to identify and prevent malicious network traffic from entering the protected network. As the complexity and diversity of network attacks continue to increase, traditional network security tools (such as rule-based and signature-based detection methods) can no longer effectively deal with new attacks and variants. In addition, although existing deep learning-based traffic detection methods can capture complex nonlinear features, they have high computational complexity, long training time, and a large demand for large-scale training data, making it difficult to operate efficiently in resource-constrained environments (such as IoT devices).

[0003] Existing network attack traffic detection technology solutions include: (1) Rule- and signature-based detection methods, which rely on predefined rules and signatures to detect known attack patterns, are ineffective against new attacks and variants and can be easily bypassed by attackers.

[0004] (2) Traffic detection methods based on deep learning, such as recurrent neural networks (RNNs), long short-term memory networks (LSTMs), and convolutional neural networks (CNNs), can capture complex features in network traffic, but they require a lot of computing resources and training data and are difficult to run efficiently in real-time environments.

[0005] (3) Detection methods based on graph neural networks, such as GraphSAGE, can process graph structured data and capture the relationships between nodes, but they are mainly used for node classification and are difficult to directly apply to edge classification tasks.

[0006] In summary, the existing network attack traffic detection technology solutions have the following defects: (1) Insufficient detection capabilities for new attacks: Traditional methods cannot effectively detect unknown attacks and can be easily bypassed by attackers.

[0007] (2) High computing resource requirements: Existing deep learning models require a lot of computing resources and time to train, making them difficult to apply in resource-constrained environments.

[0008] (3) Large data requirements: Deep learning models require a large amount of training data, but it is difficult to obtain sufficient data in a short period of time in the real network environment.

[0009] (4) Poor real-time performance: Existing methods take a long time to process large-scale data and are difficult to meet the needs of real-time detection. Summary of the invention

[0010] In view of this, an embodiment of the present invention provides a lightweight network attack traffic detection method and system based on graph neural network to eliminate or improve one or more defects existing in the prior art.

[0011] On the one hand, the present invention provides a lightweight network attack traffic detection method based on graph neural network, the method comprising the following steps: Obtain the network traffic to be detected, and construct a traffic relationship graph with the IP address and port number of the network traffic as nodes and the network flow as edges; Extracting multi-dimensional features from the network traffic, performing standardization processing, and constructing edge feature vectors; The traffic relationship graph and the edge feature vector are input into the pre-trained detection model to generate a classification result of the network traffic to be detected; wherein the detection model adopts the GraphSAGE model, aggregates the information of nodes and edges through a message passing mechanism, and generates a classification result for each edge.

[0012] In some embodiments of the present invention, the traffic relationship graph is constructed with the IP address and port number of the network traffic as nodes and the network flow as edges, further comprising: Nodes are defined using only tuples of destination IP address and port number to avoid a star graph structure.

[0013] In some embodiments of the present invention, extracting multidimensional features from the network traffic and performing standardization processing to construct edge feature vectors includes: The multi-dimensional features include at least data packet features, flow features and statistical features; The mean and standard deviation of the extracted features are calculated respectively to calculate the standardized feature value. The calculation formula is: ; in, After standardization The first eigenvalues; Before standardization The first eigenvalues; For the The mean of the features; For the The standard deviation of a feature.

[0014] In some embodiments of the present invention, the detection model adopts the GraphSAGE model, which aggregates node and edge information through a message passing mechanism, including: For each node, sample its neighbor nodes and corresponding edges; aggregate the representations of the neighbor nodes and edge features to generate neighbor aggregation information, which is calculated as follows: ; in, Based on Sampling neighborhood of the layer At the node Aggregate information about neighbors at is an aggregate function; For the Layer Node Representation of; For the Layer Node Connect edges to sampling nodes Representation of; The sampling neighborhood The sampling edges in ; The neighbor aggregation information is concatenated with the representation of the current node, and a new node representation is generated through nonlinear transformation. The update calculation formula is: ; in, For the Layer Node Representation of; is a nonlinear activation function; For the The weight of the layer; Information is aggregated for the neighbors.

[0015] In some embodiments of the present invention, the detection model adopts a GraphSAGE model, including an input layer, a GraphSAGE layer and a classification layer: Inputting the traffic relationship graph and the edge feature vector into the input layer to generate an initial node representation; Inputting the node initial representation and the edge feature vector into the GraphSAGE layer to generate an updated node representation; The updated node representation is input into the classification layer, and for each edge, the node representations at both ends are spliced; the spliced ​​node representation is subjected to linear transformation to generate the classification score of the edge; the probability of each edge belonging to each category is calculated according to the classification score to obtain the final classification result.

[0016] In some embodiments of the present invention, the method for training the detection model comprises the following steps: Obtain a network traffic data set, and construct a traffic relationship graph using the IP address and port number of each network traffic in the network traffic data set as nodes and the network flow as edges; extract multidimensional features from the network traffic data set, perform standardization processing, and construct an edge feature vector; Constructing an initial detection model, wherein the initial detection model adopts a GraphSAGE model; The network traffic data set is used to train the initial detection model, the traffic relationship graph and the edge feature vector are input into the initial detection model, the information of nodes and edges is aggregated through a message passing mechanism, and a classification result of each edge is generated; the loss between the classification result and the true classification label is constructed, and the initial detection model is optimized with the goal of minimizing the loss, and finally the detection module is trained.

[0017] In some embodiments of the present invention, constructing the loss between the classification result and the true classification label includes: Using the cross entropy function as the loss function, the calculation formula is: ; in, is the loss between the classification result and the true classification label; Indicates the number of categories; is the true classification label; is the classification result.

[0018] In some embodiments of the present invention, Adam is used as a training optimizer to optimize the training of the detection model, and the parameter update calculation formula is: ; in, for Always check model parameters; is the learning rate; and are the first-order moment and second-order moment estimates of the gradient, respectively; is a constant.

[0019] On the other hand, the present invention also provides a lightweight network attack traffic detection system based on graph neural network, the system comprising: A graph construction module, used to obtain the network traffic to be detected, and to construct a traffic relationship graph with the IP address and port number of the network traffic as nodes and the network flow as edges; A feature extraction module, used to extract multi-dimensional features from the network traffic, perform standardization processing, and construct edge feature vectors; The detection module includes a pre-trained detection model, wherein the detection model adopts a GraphSAGE model and is used to generate a classification result of the network traffic to be detected based on the traffic relationship graph and the edge feature vector.

[0020] On the other hand, the present invention further provides a computer-readable storage medium having a computer program / instruction stored thereon, which implements the steps of any of the methods mentioned above when executed by a processor.

[0021] The present invention provides a lightweight network attack traffic detection method and system based on graph neural network, including: obtaining the network traffic to be detected, taking the IP address and port number of the network traffic as nodes and the network flow as edges, and constructing a traffic relationship graph; extracting multidimensional features from the network traffic, and performing standardization processing to construct edge feature vectors; inputting the traffic relationship graph and edge feature vectors into the pre-trained GraphSAGE detection model, aggregating the information of nodes and edges through a message passing mechanism, and generating classification results of the network traffic to be detected. The detection method provided by the present invention reduces the dependence on large-scale training data through efficient graph sampling and feature extraction; reduces the computational complexity through graph neural network and graph sampling technology, and is suitable for real-time detection; effectively captures the complex relationships in network traffic, and improves the accuracy of attack traffic detection; adopts a lightweight design, reduces resource consumption, and is suitable for resource-constrained environments.

[0022] Additional advantages, purposes, and features of the present invention will be described in part in the following description, and will become apparent to those skilled in the art after studying the following, or may be learned from the practice of the present invention. The purposes and other advantages of the present invention may be achieved and obtained by the structures specifically indicated in the specification and the accompanying drawings.

[0023] Those skilled in the art will appreciate that the objectives and advantages that can be achieved with the present invention are not limited to the above specific description, and the above and other objectives that can be achieved by the present invention will be more clearly understood from the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The drawings described herein are used to provide a further understanding of the present invention, constitute a part of the present application, and do not constitute a limitation of the present invention. In the drawings: Figure 1 This is a schematic diagram of the steps of a lightweight network attack traffic detection method based on a graph neural network in one embodiment of the present invention.

[0025] Figure 2 It is a schematic diagram of the structure of a flow relationship diagram in one embodiment of the present invention.

[0026] Figure 3This is a schematic diagram of the message transmission mechanism in the GraphSAGE layer in one embodiment of the present invention.

[0027] Figure 4 It is a schematic diagram of the detection model structure based on preset parameters in one embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments and the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0029] It should also be noted that, in order to avoid obscuring the present invention due to unnecessary details, only structures and / or processing steps closely related to the solutions according to the present invention are shown in the accompanying drawings, while other details that are not closely related to the present invention are omitted.

[0030] It should be emphasized that the term “include / comprises” when used herein refers to the presence of features, elements, steps or components, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0031] It should also be noted that, unless otherwise specified, the term “connection” herein may refer not only to a direct connection but also to an indirect connection involving an intermediate.

[0032] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In the accompanying drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0033] It should be emphasized here that the step marks mentioned below are not intended to limit the order of the steps, but it should be understood that the steps can be executed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be executed simultaneously.

[0034] In order to solve the problems of insufficient detection capability for new attacks, high computing resource requirements, large data requirements and poor real-time performance in existing network attack traffic detection technical solutions, the present invention provides a lightweight network attack traffic detection method based on graph neural network, such as Figure 1 As shown, the method includes the following steps S101-S103: Step S101: Obtain the network traffic to be detected, and construct a traffic relationship graph with the IP address and port number of the network traffic as nodes and the network flow as edges.

[0035] Step S102: extract multi-dimensional features from network traffic, perform standardization processing, and construct edge feature vectors.

[0036] Step S103: Input the traffic relationship graph and edge feature vector into the pre-trained detection model to generate the classification result of the network traffic to be detected. The detection model adopts the GraphSAGE model, aggregates the information of nodes and edges through the message passing mechanism, and generates the classification result of each edge.

[0037] In step S101, the network traffic data is converted into a graph structure to construct a traffic relationship graph.

[0038] Network traffic consists of five tuples, including: srcip (source IP address), dstip (destination IP address), sport (source port), dport (destination port), and protocol. These tuples provide basic information about the communication session. Based on this information, network traffic can be represented as a graph structure.

[0039] When constructing a traffic relationship graph, nodes and edges are first defined.

[0040] Node: A node is a combination of an IP address and a port number. For example, the source IP address and source port can be one node, and the destination IP address and destination port can be another node.

[0041] Edge: An edge represents a network flow, connecting a source node and a destination node. Each edge contains statistical characteristics of the network flow, such as packet size, flow duration, packet count, etc.

[0042] In some embodiments, if there is a central node (such as a server or device) in the network traffic that communicates with a large number of other nodes, that is, all traffic is concentrated on a few nodes, the graph structure will present a star topology, which will reduce the learning effect of the graph neural network.

[0043] To avoid this problem, this embodiment only uses the tuple of the destination IP address and the port number to define the node. After the improvement, even if multiple third-party services may be deployed on the same server (i.e., the same IP address), they use different port numbers. For example, IE browser and Google browser may share the same IP address, but use different port numbers (IE browser uses 857, Google browser uses 998). In this way, the topological structure of network traffic can be better represented, avoiding the problem of star graph.

[0044] After the improvement, although the source IP address and port number are not considered as nodes, they are not completely ignored and can be processed as attributes or features of the edge. Specifically: each edge (i.e., network flow) still contains information about the source IP address and source port number, which can be used as part of the feature vector of the edge. The topological structure of the traffic relationship graph is determined by the connection relationship between the destination nodes, and the information of the source node can be transmitted through the edge features.

[0045] The traffic relationship diagram constructed can be shown as Figure 2 As shown in the figure, IP represents the destination IP address and Port represents the destination port.

[0046] In step S102, multi-dimensional features are extracted from network traffic, and standardized to construct edge feature vectors.

[0047] First, multi-dimensional features are extracted from network traffic, such as packet features, flow features, statistical features, etc., including: Packet characteristics: such as packet size, packet arrival timestamp, etc.

[0048] Flow characteristics: such as flow duration, number of packets in the flow, byte transfer rate, etc.

[0049] Statistical characteristics: such as the mean, variance, and standard deviation of the packet size.

[0050] The above features can comprehensively describe the behavior patterns of network traffic and help the model distinguish between normal traffic and attack traffic.

[0051] In some embodiments, since different features may have different dimensions (for example, the numerical ranges of packet size and flow duration vary greatly), directly using these features may cause some features to have too great an impact on model training. Therefore, it is necessary to standardize the features.

[0052] Assuming there are n edges in the network traffic and each edge has d features, the standardization process is as follows: Calculate the mean value as shown in formula (1): ; (1) in, For the The mean of the features; Before standardization The first feature values.

[0053] Calculate the standard deviation as shown in formula (2): ; (2) in, For the The standard deviation of a feature.

[0054] The standardized eigenvalue is calculated as shown in formula (3): ; (3) in, After standardization The first feature values.

[0055] After normalization, the edge feature vector is constructed as shown in formula (4): ; (4) in, Right now , after standardization The first feature values.

[0056] In step S103, the traffic relationship graph constructed in step S101 and the edge feature vector constructed in step S102 are input into the pre-trained detection model to generate a classification result of the network traffic to be detected.

[0057] First, the training method of the detection model is described. The training method of the detection model includes the following steps S1031~S1033: Step S1031: Obtain a network traffic data set, and construct a traffic relationship graph with the IP address and port number of each network traffic in the network traffic data set as nodes and the network flow as edges; extract multidimensional features from the network traffic data set, perform standardization processing, and construct an edge feature vector.

[0058] Step S1032: construct an initial detection model, which uses a GraphSAGE model.

[0059] Step S1033: Use the network traffic data set to train the initial detection model, input the traffic relationship graph and edge feature vector into the initial detection model, aggregate the information of nodes and edges through the message passing mechanism, and generate the classification result of each edge; construct the loss between the classification result and the true classification label, with the goal of minimizing the loss, optimize the initial detection model, and finally train the detection module.

[0060] In step S1031, a training data set is constructed.

[0061] In some embodiments, public network traffic datasets are used, such as the CICDDOS 2019 dataset, the MQTT-IoT-IDS 2020 dataset, and the CICIoT 2023 dataset. These datasets contain normal traffic and multiple types of attack traffic, and can provide rich network traffic characteristics.

[0062] In some embodiments, data preprocessing operations such as category rebalancing, feature processing, and missing value processing are performed on the network traffic data set.

[0063] In some embodiments, the network traffic data set is divided into a training set and a test set according to a preset ratio, such as 7:3, wherein the training set is used for model training and the test set is used for performance testing of the model after training.

[0064] The IP address and port number of each network flow in the network flow data set are used as nodes and the network flow is used as an edge to construct a flow relationship graph. Figure 2 As shown, only tuples of destination IP address and port number are used as nodes to avoid a star graph structure.

[0065] Multidimensional features are extracted from the network traffic data set, as described in step 101, and the extracted features include data packet features, flow features, statistical features, etc.

[0066] In some embodiments, the feature size extracted and derived from the network traffic data set ranges from 70 to 90. It should be noted that although a large number of traffic features are used to describe network traffic, the data sample is relatively small and there is no need to worry about data dimension explosion.

[0067] As shown in Table 1, this is a list of edge features of the traffic relationship graph, which provides all possible features for the graph neural network to calculate without feature screening. The message passing ability of the graph neural network is used to comprehensively learn the potential features of the data. This reduces the work of feature engineering and selection, and provides the maximum information collected from the network traffic dataset to achieve the highest performance in mobile application classification.

[0068] Table 1 List of edge features of the traffic relationship graph As described in step S102, considering that the dimensions of different features may be different, the features are standardized using the method shown in formulas (1) to (3), and finally an edge feature vector shown in formula (4) is generated.

[0069] In step S1032, an initial detection model is constructed, and the initial detection model adopts a GraphSAGE model.

[0070] GraphSAGE is a graph neural network (GNN) model for node classification, which is usually used to learn the representation of nodes. It is an unsupervised or semi-supervised method that is not directly used for edge classification, but for node classification. In this application, node features are combined with edge features in the same dimension and input into the GraphSAGE layer for sampling and aggregation of edge information.

[0071] All nodes are set to the same default value, and the dimension of the node feature is equal to the dimension of the edge feature. During each message passing process, the source node feature, edge feature, and target node feature are concatenated on the same dimension. The purpose of this is to not only input the edge feature, but also incorporate the calculation of the target node during the training data, so that the model can identify nodes with higher degrees, that is, important nodes, so that the nodes carry richer information in each message passing. As a result, the original classification results are used to infer the classification results of the edges.

[0072] Based on the above description, the present application improves the original GraphSAGE model, and inputs the traffic relationship graph and edge feature vector obtained based on the network traffic data set into the initial detection model.

[0073] In some embodiments, the detection module includes an input layer, a GraphSAGE layer, and a classification layer.

[0074] In the input layer: the traffic relationship graph and edge feature vector are input into the input layer to generate the initial representation of the node.

[0075] In the GraphSAGE layer: The initial node representation and edge feature vector are input into the GraphSAGE layer to generate the updated node representation.

[0076] Specifically, considering that the data sample is relatively small, there is almost no impact on the runtime efficiency of the model between randomly sampling adjacent nodes and fully sampling adjacent nodes, but there is a significant impact on the information collected by the nodes. Therefore, in this case, the application fully samples the adjacent nodes.

[0077] like Figure 3 As shown in, for each node, its neighbor nodes and corresponding edges are sampled, the representation of the neighbor nodes and the edge features are aggregated to generate neighbor aggregation information, as shown in formula (5): ; (5) in, Based on Sampling neighborhood of the layer At the node Aggregate information about neighbors at is an aggregate function; For the Layer Node Representation of; For the Layer Node Connect edges to sampling nodes Representation of; The sampling neighborhood The sampling edges in .

[0078] In some embodiments, a Leaky ReLU activation function is added to each layer of the GraphSAGE layer to perform nonlinear transformation processing; and a Dropout layer is applied after the GraphSAGE layer to prevent the model from overfitting.

[0079] The neighbor aggregation information is concatenated with the representation of the current node, and a nonlinear transformation is performed through the Leaky ReLU activation function to generate a new node representation, as shown in formula (6): ; (6) in, For the Layer Node Representation of; is a nonlinear activation function; For the The weight of the layer; Aggregate information for neighbors.

[0080] In some embodiments, two GraphSAGE layers are used, namely =2, each node aggregates data from neighbors in two hops, the hidden unit size of each layer is set to 128, and the Dropout probability is 0.2. The detection model structure based on the above parameters is as follows Figure 4 shown.

[0081] In the classification layer: the representations of the source node and the target node are concatenated, the classification scores of the edges are generated through linear transformation, and the softmax function is used to calculate the probability that each edge belongs to each category.

[0082] Specifically, a multi-layer perceptron (MLP) predictor is used, which uses a linear function to apply a linear transformation to the data. The output of the linear function is called a feature representation vector, and the initialization of the linear layer is shown in formula (7): ; (7) in, is the weight of the linear layer; is the real number space; is the input feature dimension; is the number of output classes. Specifically, formula (7) represents the linear layer weight matrix The initialization form is, is a real matrix with rows , that is, the input feature is the concatenation of the source node and the target node representation, and the number of columns is , which represents the number of output categories.

[0083] Calculate the prediction score of each network flow as shown in formulas (8) and (9): ; (8) ; (9) in, For source node The feature vector of , which is the final representation of the source node after being processed by the GraphSAGE layer; The target node The feature vector of , which is the final representation of the target node after being processed by the GraphSAGE layer; is the weight of the linear layer; Indicates that the prediction score vector is a real vector whose length is the number of output categories ; express and is a real vector whose length is the dimension of the input features .

[0084] In step S1033, the network traffic data set is used to train the initial detection model; the loss between the classification result and the true classification label is constructed, and the initial detection model is optimized with the goal of minimizing the loss, and finally the detection module is trained.

[0085] In some embodiments, a cross entropy function is used as a loss function, and the calculation formula is shown in formula (10): ; (10) in, is the loss between the classification result and the true classification label; Indicates the number of categories; is the true classification label; For classification results.

[0086] In some embodiments, Adam is used as a training optimizer to optimize the training of the detection model. Adam is a progressive optimization algorithm based on adaptive moment estimation of low-order moments of a random objective function. It gradually optimizes the model parameters and reduces the value of the loss function. It is an effective random optimization method that only requires first-order gradients and a small amount of memory. The parameter update calculation formula based on Adam is shown in formula (11): ; (11) in, for Always check model parameters; is the learning rate; and are the first-order moment and second-order moment estimates of the gradient, respectively; is a constant.

[0087] The traffic relationship graph constructed in step S101 and the edge feature vector constructed in step S102 are input into the detection model trained based on steps S1031 to S1033, and finally a classification result of the network traffic to be detected is generated.

[0088] The lightweight network attack traffic detection method based on graph neural network provided by this application is further explained below in conjunction with a specific embodiment.

[0089] The publicly available CICDDOS 2019 dataset, MQTT-IoT-IDS 2020 dataset, and CICIoT 2023 dataset are used as network traffic datasets.

[0090] The network traffic dataset is processed by class rebalancing, sample reduction, feature processing, and missing value removal.

[0091] The detailed information of the network traffic dataset is shown in Table 2.

[0092] Table 2 Network traffic dataset information Based on the training method of steps S1031 to S1033, the final detection module is obtained by training with the network traffic data set. In this embodiment, the detection module provided by the present application is compared with the existing ERNN model, E-GraphSAGE model and FS-Net model, and it is found that the detection module provided by the present application has higher classification efficiency, classification accuracy and more superior classification performance.

[0093] Corresponding to the above method, the present invention also provides a lightweight network attack traffic detection system based on graph neural network, the system comprising: The graph construction module is used to obtain the network traffic to be detected, and construct a traffic relationship graph with the IP address and port number of the network traffic as nodes and the network flow as edges.

[0094] The feature extraction module is used to extract multi-dimensional features from network traffic and perform standardization to construct edge feature vectors.

[0095] The detection module includes a detection model obtained by pre-training based on steps S1031 to S1033. The detection model adopts a GraphSAGE model to generate a classification result of the network traffic to be detected based on the traffic relationship graph and the edge feature vector.

[0096] Corresponding to the above method, the present invention also provides an electronic device, which includes a computer device, the computer device includes a processor and a memory, the memory stores computer instructions, the processor is used to execute the computer instructions stored in the memory, and when the computer instructions are executed by the processor, the electronic device implements the steps of the method described above.

[0097] The embodiment of the present invention also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the aforementioned edge computing server deployment method are implemented. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0098] It should be understood by those skilled in the art that the exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention. When implemented in hardware, it can be, for example, an electronic circuit, an application-specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present invention are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.

[0099] It should be clear that the present invention is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present invention.

[0100] In the present invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with features of other embodiments or replace features of other embodiments.

[0101] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the embodiments of the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A lightweight network attack traffic detection method based on graph neural network, characterized in that: The method comprises the following steps: Obtain the network traffic to be detected, and construct a traffic relationship graph with the IP address and port number of the network traffic as nodes and the network flow as edges; Extracting multi-dimensional features from the network traffic, performing standardization processing, and constructing edge feature vectors; The traffic relationship graph and the edge feature vector are input into the pre-trained detection model to generate a classification result of the network traffic to be detected; wherein the detection model adopts the GraphSAGE model, aggregates the information of nodes and edges through a message passing mechanism, and generates a classification result for each edge.

2. According to claim 1, the lightweight network attack traffic detection method based on graph neural network is characterized in that: The IP address and port number of the network traffic are used as nodes and the network flow is used as an edge to construct a traffic relationship graph, which also includes: Nodes are defined using only tuples of destination IP address and port number to avoid a star graph structure.

3. According to claim 1, the lightweight network attack traffic detection method based on graph neural network is characterized in that: Multi-dimensional features are extracted from the network traffic, and standardized to construct edge feature vectors, including: The multi-dimensional features include at least data packet features, flow features and statistical features; The mean and standard deviation of the extracted features are calculated respectively to calculate the standardized feature value. The calculation formula is: ； in, After standardization The first eigenvalues; Before standardization The first eigenvalues; For the The mean of the features; For the The standard deviation of a feature.

4. According to claim 1, the lightweight network attack traffic detection method based on graph neural network is characterized in that: The detection model adopts the GraphSAGE model, which aggregates node and edge information through a message passing mechanism, including: For each node, sample its neighbor nodes and corresponding edges; aggregate the representations of the neighbor nodes and edge features to generate neighbor aggregation information, which is calculated as follows: ； in, Based on Sampling neighborhood of the layer At the node Aggregate information about neighbors at is an aggregate function; For the Layer Node ' For the Layer Node Connect edges to sampling nodes ' The sampling neighborhood The sampling edges in ; The neighbor aggregation information is concatenated with the representation of the current node, and a new node representation is generated through nonlinear transformation. The update calculation formula is: ； in, For the Layer Node ' is a nonlinear activation function; For the The weight of the layer; Information is aggregated for the neighbors.

5. According to claim 4, the lightweight network attack traffic detection method based on graph neural network is characterized in that: The detection model adopts the GraphSAGE model, including an input layer, a GraphSAGE layer, and a classification layer: Inputting the traffic relationship graph and the edge feature vector into the input layer to generate an initial node representation; Inputting the initial node representation and the edge feature vector into the GraphSAGE layer to generate an updated node representation; Input the updated node representation into the classification layer, and for each edge, concatenate the node representations at both ends thereof; The concatenated node representations are linearly transformed to generate edge classification scores; the probability of each edge belonging to each category is calculated based on the classification scores to obtain the final classification result.

6. The lightweight network attack traffic detection method based on graph neural network according to claim 1 is characterized in that: The training method of the detection model comprises the following steps: Obtain a network traffic data set, and construct a traffic relationship graph using the IP address and port number of each network traffic in the network traffic data set as nodes and the network flow as edges; extract multidimensional features from the network traffic data set, perform standardization processing, and construct an edge feature vector; Constructing an initial detection model, wherein the initial detection model adopts a GraphSAGE model; The network traffic data set is used to train the initial detection model, the traffic relationship graph and the edge feature vector are input into the initial detection model, the information of nodes and edges is aggregated through a message passing mechanism, and a classification result of each edge is generated; the loss between the classification result and the true classification label is constructed, and the initial detection model is optimized with the goal of minimizing the loss, and finally the detection module is trained.

7. The lightweight network attack traffic detection method based on graph neural network according to claim 6 is characterized in that: Constructing the loss between the classification result and the true classification label includes: Using the cross entropy function as the loss function, the calculation formula is: ； in, is the loss between the classification result and the true classification label; Indicates the number of categories; is the true classification label; is the classification result.

8. The lightweight network attack traffic detection method based on graph neural network according to claim 6 is characterized in that: Adam is used as the training optimizer to optimize the training of the detection model. The parameter update calculation formula is: ； in, for Always check model parameters; is the learning rate; and are the first-order moment and second-order moment estimates of the gradient, respectively; is a constant.

9. A lightweight network attack traffic detection system based on graph neural network, characterized in that: The system comprises: A graph construction module, used to obtain the network traffic to be detected, and to construct a traffic relationship graph with the IP address and port number of the network traffic as nodes and the network flow as edges; A feature extraction module, used to extract multi-dimensional features from the network traffic, perform standardization processing, and construct edge feature vectors; The detection module includes a pre-trained detection model, wherein the detection model adopts a GraphSAGE model and is used to generate a classification result of the network traffic to be detected based on the traffic relationship graph and the edge feature vector.

10. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images