Lightweight network attack traffic detection method and system based on graph neural network

Abstract

This invention provides a lightweight network attack traffic detection method and system based on graph neural networks, comprising: acquiring the network traffic to be detected; constructing a traffic relationship graph using IP addresses and port numbers of the network traffic as nodes and network flows as edges; extracting multi-dimensional features from the network traffic and performing standardization processing to construct edge feature vectors; inputting the traffic relationship graph and edge feature vectors into a pre-trained GraphSAGE detection model, and aggregating node and edge information through a message passing mechanism to generate a classification result of the network traffic to be detected. The detection method provided by this invention can achieve high-precision network attack traffic detection and is suitable for real-time detection and resource-constrained environments.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network attack traffic detection, and particularly relates to a lightweight network attack traffic detection method and system based on a graph neural network. BACKGROUND

[0002] Network attack traffic detection is a key task in the field of network security, aiming to identify and prevent malicious network traffic from entering protected networks. With the increasing complexity and diversity of network attacks, traditional network security tools such as rule-based and signature-based detection methods have been unable to effectively cope with new attacks and variants. In addition, existing deep learning-based traffic detection methods, although they can capture complex nonlinear features, have high computational complexity, long training times, and require large amounts of training data, making it difficult to efficiently run in resource-constrained environments such as Internet of Things devices.

[0003] Existing network attack traffic detection technical solutions include:

[0004] (1) Rule and signature-based detection methods, which rely on predefined rules and signatures to detect known attack patterns, but are ineffective against new attacks and variants, and are easily bypassed by attackers.

[0005] (2) Deep learning-based traffic detection methods, such as recurrent neural networks (RNN), long short-term memory networks (LSTM), and convolutional neural networks (CNN), which can capture complex features in network traffic, but require a large amount of computational resources and training data, making it difficult to efficiently run in real-time environments.

[0006] (3) Graph neural network-based detection methods, such as GraphSAGE, which can handle graph-structured data and capture relationships between nodes, but are mainly used for node classification and are difficult to directly apply to edge classification tasks.

[0007] In summary, existing network attack traffic detection technical solutions have the following defects:

[0008] (1) Insufficient detection capability for new attacks: traditional methods cannot effectively detect unknown attacks and are easily bypassed by attackers.

[0009] (2) High demand for computational resources: existing deep learning models require a large amount of computational resources and time for training, making it difficult to apply in resource-constrained environments.

[0010] (3) Large data requirements: deep learning models require a large amount of training data, which is difficult to obtain in a short period of time in real network environments.

[0011] (4) Poor real-time performance: existing methods take a long time to process large-scale data, making it difficult to meet the needs of real-time detection. Summary of the Invention

[0012] In view of this, embodiments of the present invention provide a lightweight network attack traffic detection method and system based on graph neural networks to eliminate or improve one or more defects existing in the prior art.

[0013] On one hand, the present invention provides a lightweight network attack traffic detection method based on graph neural networks, the method comprising the following steps:

[0014] Obtain the network traffic to be detected, and construct a traffic relationship graph using the IP address and port number of the network traffic as nodes and the network flow as edges;

[0015] Multidimensional features are extracted from the network traffic and standardized to construct edge feature vectors;

[0016] The traffic relationship graph and the edge feature vector are input into the pre-trained detection model to generate the classification result of the network traffic to be detected; wherein, the detection model adopts the GraphSAGE model, which aggregates the information of nodes and edges through a message passing mechanism to generate the classification result of each edge.

[0017] In some embodiments of the present invention, a traffic relationship graph is constructed using the IP address and port number of the network traffic as nodes and the network flow as edges, further comprising:

[0018] Nodes are defined using only tuples of destination IP address and port number to avoid star graph structures.

[0019] In some embodiments of the present invention, multidimensional features are extracted from the network traffic and standardized to construct edge feature vectors, including:

[0020] The multidimensional features include at least packet features, flow features, and statistical features;

[0021] Calculate the mean and standard deviation of the extracted features to determine the standardized eigenvalues. The formula is as follows:

[0022] ;

[0023] in, For the standardized processing of the first The first edge One eigenvalue; Before standardization processing The first edge One eigenvalue; For the first The mean of each feature; For the first The standard deviation of each feature.

[0024] In some embodiments of the present application, the detection model adopts a GraphSAGE model, which aggregates the information of nodes and edges through a message passing mechanism, including:

[0025] For each node, sample its neighbor nodes and corresponding edges; aggregate the representation of the neighbor nodes and edge features to generate neighbor aggregation information, and the calculation formula is:

[0026] ;

[0027] Wherein, is the representation of the node at the first layer based on the sampled neighborhood of the node at the first layer; is the neighbor aggregation information at the node ; is the aggregation function; is the representation of the node at the first layer; is the representation of the node at the first layer connected to the sampling node edge ; is the sampling edge in the sampling neighborhood ; is the sampling edge in the sampling neighborhood ; is the sampling edge in the sampling neighborhood ;

[0028] Concatenate the neighbor aggregation information with the representation of the current node, generate a new node representation through a nonlinear transformation, and update the calculation formula as:

[0029] ;

[0030] Wherein, is the representation of the node at the first layer; is the nonlinear activation function; is the weight of the first layer; is the neighbor aggregation information. In some embodiments of the present application, the detection model adopts a GraphSAGE model, including an input layer, a GraphSAGE layer and a classification layer:

[0031] Input the traffic relationship graph and the edge feature vector into the input layer to generate a node initial representation;

[0032] Input the node initial representation and the edge feature vector into the GraphSAGE layer to generate an updated node representation;

[0033] Input the node initial representation and the edge feature vector into the GraphSAGE layer to generate an updated node representation;

[0034] ​​The updated node representation is input into the classification layer. For each edge, the node representations at both ends are concatenated. The concatenated node representation is then subjected to a linear transformation to generate a classification score for the edge. Based on the classification score, the probability of each edge belonging to each category is calculated to obtain the final classification result.

[0035] In some embodiments of the present invention, the training method of the detection model includes the following steps:

[0036] Obtain a network traffic dataset, and construct a traffic relationship graph using the IP address and port number of each network traffic in the dataset as nodes and network flow as edges; extract multi-dimensional features from the network traffic dataset, perform standardization processing, and construct edge feature vectors.

[0037] An initial detection model is constructed, which adopts the GraphSAGE model;

[0038] The initial detection model is trained using the network traffic dataset. The traffic relationship graph and the edge feature vector are input into the initial detection model. The information of nodes and edges is aggregated through a message passing mechanism to generate the classification result of each edge. The loss between the classification result and the true classification label is constructed. The initial detection model is optimized with the goal of minimizing the loss, and finally the detection module is trained.

[0039] In some embodiments of the present invention, constructing the loss between the classification result and the true classification label includes:

[0040] Using the cross-entropy function as the loss function, the calculation formula is:

[0041] ;

[0042] in, The loss between the classification result and the true classification label; Indicates the number of categories; The actual category label; The classification result is as described.

[0043] In some embodiments of the present invention, Adam is used as a training optimizer to optimize the training of the detection model, and the parameter update calculation formula is as follows:

[0044] ;

[0045] in, for Detect model parameters at any time; The learning rate; and These are the first and second moments of the gradient, respectively; It is a constant.

[0046] On the other hand, the present invention also provides a lightweight network attack traffic detection system based on graph neural networks, the system comprising:

[0047] The graph construction module is used to acquire the network traffic to be detected, and construct a traffic relationship graph using the IP address and port number of the network traffic as nodes and the network flow as edges.

[0048] The feature extraction module is used to extract multi-dimensional features from the network traffic, perform standardization processing, and construct edge feature vectors.

[0049] The detection module includes a pre-trained detection model, which employs the GraphSAGE model to generate classification results for the network traffic to be detected based on the traffic relationship graph and the edge feature vectors.

[0050] On the other hand, the present invention also provides a computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implement the steps of any of the methods mentioned above.

[0051] This invention provides a lightweight network attack traffic detection method and system based on graph neural networks, comprising: acquiring the network traffic to be detected; constructing a traffic relationship graph using IP addresses and port numbers of the network traffic as nodes and network flows as edges; extracting multi-dimensional features from the network traffic and performing standardization processing to construct edge feature vectors; inputting the traffic relationship graph and edge feature vectors into a pre-trained GraphSAGE detection model, aggregating node and edge information through a message passing mechanism to generate a classification result of the network traffic to be detected. The detection method provided by this invention reduces dependence on large-scale training data through efficient graph sampling and feature extraction; reduces computational complexity through graph neural networks and graph sampling techniques, making it suitable for real-time detection; effectively captures complex relationships in network traffic, improving the accuracy of attack traffic detection; and adopts a lightweight design, reducing resource consumption and making it suitable for resource-constrained environments.

[0052] Additional advantages, objects, and features of the invention will be set forth in part in the description which follows, and will also become apparent in part to those skilled in the art upon studying the description, or may be learned by practice of the invention. The objects and other advantages of the invention can be realized and obtained by means of the structures specifically pointed out in the description and drawings.

[0053] Those skilled in the art will understand that the objectives and advantages achievable with the present invention are not limited to those specifically described above, and that the above and other objectives achievable with the present invention will become clearer from the following detailed description. Attached Figure Description

[0054] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, are not intended to limit the scope of the invention. In the drawings:

[0055] Figure 1 This is a schematic diagram illustrating the steps of a lightweight network attack traffic detection method based on graph neural networks in one embodiment of the present invention.

[0056] Figure 2 This is a schematic diagram of the flow relationship diagram in one embodiment of the present invention.

[0057] Figure 3 This is a schematic diagram of the message passing mechanism in the GraphSAGE layer in one embodiment of the present invention.

[0058] Figure 4 This is a schematic diagram of the detection model structure based on preset parameters in one embodiment of the present invention. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this invention are used to explain the invention, but are not intended to limit the invention.

[0060] It should also be noted that, in order to avoid obscuring the invention with unnecessary details, only the structures and / or processing steps closely related to the solution according to the invention are shown in the accompanying drawings, while other details that are not closely related to the invention are omitted.

[0061] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0062] It should also be noted that, unless otherwise specified, the term "connection" in this article can refer not only to a direct connection, but also to an indirect connection involving an intermediary.

[0063] In the following description, embodiments of the invention will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0064] It should be emphasized here that the step markers mentioned below are not a limitation on the order of the steps, but should be understood as meaning that the steps can be executed in the order mentioned in the embodiments, or in a different order than in the embodiments, or several steps can be executed simultaneously.

[0065] To address the shortcomings of existing network attack traffic detection technologies, such as insufficient detection capability against novel attacks, high computational resource requirements, large data demands, and poor real-time performance, this invention provides a lightweight network attack traffic detection method based on graph neural networks, such as... Figure 1 As shown, the method includes the following steps S101~S103:

[0066] Step S101: Obtain the network traffic to be detected, and construct a traffic relationship graph with the IP address and port number of the network traffic as nodes and the network flow as edges.

[0067] Step S102: Extract multi-dimensional features from network traffic, perform standardization processing, and construct edge feature vectors.

[0068] Step S103: Input the traffic relationship graph and edge feature vectors into the pre-trained detection model to generate classification results for the network traffic to be detected. The detection model uses the GraphSAGE model, which aggregates node and edge information through a message passing mechanism to generate a classification result for each edge.

[0069] In step S101, the network traffic data is transformed into a graph structure to construct a traffic relationship graph.

[0070] Network traffic consists of five tuples: srcip (source IP address), dstip (destination IP address), sport (source port), dport (destination port), and protocol. These tuples provide basic information about the communication session. Based on this information, network traffic can be represented as a graph structure.

[0071] When constructing a traffic relationship graph, the nodes and edges are defined first.

[0072] Nodes: Nodes are composed of combinations of IP addresses and port numbers. For example, a source IP address and a source port can form one node, and a destination IP address and a destination port can form another node.

[0073] Edges: Edges represent network flows, connecting source and destination nodes. Each edge contains statistical characteristics of the network flow, such as packet size, flow duration, and packet count.

[0074] In some embodiments, if a central node (such as a server or device) in the network traffic communicates with a large number of other nodes, i.e. all traffic is concentrated on a few nodes, the graph structure will exhibit a star topology, which will reduce the learning effect of the graph neural network.

[0075] To avoid this problem, this embodiment uses only a tuple of destination IP address and port number to define nodes. This improvement allows multiple third-party services to be deployed on the same server (i.e., with the same IP address) but using different port numbers. For example, Internet Explorer and Google Chrome might share the same IP address but use different port numbers (Internet Explorer uses 857, Google Chrome uses 998). This approach better represents the network traffic topology and avoids the problems of star diagrams.

[0076] After the improvement, although the source IP address and port number are no longer treated as nodes, they are not completely ignored and can be processed as attributes or features of edges. Specifically, each edge (i.e., network flow) still contains information about the source IP address and source port number, which can be used as part of the edge's feature vector. The topology of the traffic graph is determined by the connections between destination nodes, and the information of the source nodes can be transmitted through edge features.

[0077] The resulting traffic relationship graph can be as follows: Figure 2 As shown, IP represents the destination IP address, and Port represents the destination port.

[0078] In step S102, multidimensional features are extracted from network traffic and standardized to construct edge feature vectors.

[0079] First, multidimensional features are extracted from network traffic, such as packet features, flow features, and statistical features, including:

[0080] Data packet characteristics: such as data packet size, data packet arrival timestamp, etc.

[0081] Stream characteristics: such as stream duration, number of data packets in the stream, byte transfer rate, etc.

[0082] Statistical characteristics: such as the mean, variance, and standard deviation of data packet size.

[0083] These features can comprehensively describe the behavioral patterns of network traffic, helping the model distinguish between normal traffic and attack traffic.

[0084] In some embodiments, because different features may have different units (e.g., the numerical ranges of packet size and stream duration may differ significantly), directly using these features may cause some features to have an excessive impact on model training. Therefore, feature standardization is required.

[0085] Assuming there are n edges in the network traffic, and each edge has d features, the standardization process is as follows:

[0086] The mean is calculated using formula (1):

[0087] ; (1)

[0088] in, For the first The mean of each feature; Before standardization processing The first edge Each feature value.

[0089] The standard deviation is calculated using formula (2):

[0090] ; (2)

[0091] in, For the first The standard deviation of each feature.

[0092] The standardized eigenvalues ​​are calculated as shown in formula (3):

[0093] ; (3)

[0094] in, For the standardized processing of the first The first edge Each feature value.

[0095] After standardization, the edge feature vectors are constructed as shown in formula (4):

[0096] ; (4)

[0097] in, Right now , for the first after standardization The first edge Each feature value.

[0098] In step S103, the traffic relationship graph constructed in step S101 and the edge feature vector constructed in step S102 are input into the pre-trained detection model to generate the classification result of the network traffic to be detected.

[0099] First, the training method for the detection model will be explained. The training method for the detection model includes the following steps S1031~S1033:

[0100] Step S1031: Obtain the network traffic dataset, and construct a traffic relationship graph with the IP address and port number of each network traffic in the network traffic dataset as nodes and network flow as edges; extract multi-dimensional features from the network traffic dataset, perform standardization processing, and construct edge feature vectors.

[0101] Step S1032: Construct an initial detection model, which uses the GraphSAGE model.

[0102] Step S1033: Train the initial detection model using a network traffic dataset. Input the traffic relationship graph and edge feature vectors into the initial detection model. Aggregate the information of nodes and edges through a message passing mechanism to generate the classification result of each edge. Construct the loss between the classification result and the true classification label. Optimize the initial detection model with the goal of minimizing the loss, and finally train the detection module.

[0103] In step S1031, the training dataset is constructed.

[0104] In some embodiments, publicly available network traffic datasets, such as the CICDDOS 2019 dataset, the MQTT-IoT-IDS 2020 dataset, and the CICIoT 2023 dataset, are used. These datasets contain normal traffic and various types of attack traffic, providing rich network traffic characteristics.

[0105] In some embodiments, data preprocessing operations such as class rebalancing, feature processing, and missing value handling are performed on the network traffic dataset.

[0106] In some embodiments, the network traffic dataset is divided into a training set and a test set according to a preset ratio, such as 7:3. The training set is used for model training, and the test set is used for performance testing of the trained model.

[0107] A traffic relationship graph is constructed using the IP address and port number of each network traffic item in the network traffic dataset as nodes and network flows as edges. Preferably, such as... Figure 2 As shown, only tuples of destination IP address and port number are used as nodes to avoid star graph structure.

[0108] Multidimensional features are extracted from the network traffic dataset, as described in step 101. The extracted features include packet features, flow features, statistical features, etc.

[0109] In some embodiments, the feature sizes extracted and derived from the network traffic dataset range from 70 to 90. It should be noted that although a large number of traffic features are used to describe network traffic, the data sample is relatively small, so there is no need to worry about data dimensionality explosion.

[0110] Table 1 shows the edge feature list of the traffic relationship graph. This provides all possible features for the graph neural network to compute, eliminating the need for feature selection. Leveraging the message passing capability of the graph neural network, it comprehensively learns the latent features of the data. This reduces the workload of feature engineering and selection, and provides the maximum information collected from the network traffic dataset to achieve the highest performance in mobile application classification.

[0111] Table 1. List of edge features in the flow relationship graph

[0112]

[0113] As described in step S102, considering that different features may have different dimensions, the features are standardized using the methods shown in formulas (1) to (3), and finally the edge feature vectors shown in formula (4) are generated.

[0114] In step S1032, an initial detection model is constructed, which adopts the GraphSAGE model.

[0115] GraphSAGE is a graph neural network (GNN) model used for node classification, typically for learning node representations. It is an unsupervised or semi-supervised method that is used for node classification rather than edge classification. In this application, node features and edge features are combined along the same dimension and fed together into the GraphSAGE layer for edge information sampling and aggregation.

[0116] All nodes are set to the same default value, and the dimension of node features is equal to the dimension of edge features. During each message pass, the source node features, edge features, and target node features are concatenated along the same dimension. The purpose of this is to incorporate not only the edge features into the input but also the calculation of the target node during training, enabling the model to identify nodes with higher degrees—i.e., important nodes—thus allowing each node to carry richer information in each message pass. Thus, the original classification result is used to infer the edge classification result.

[0117] Based on the above description, this application improves the original GraphSAGE model by inputting the traffic relationship graph and edge feature vectors obtained from the network traffic dataset into the initial detection model.

[0118] In some embodiments, the detection module includes an input layer, a GraphSAGE layer, and a classification layer.

[0119] In the input layer: the flow relationship graph and edge feature vectors are input into the input layer to generate the initial representation of the nodes.

[0120] In the GraphSAGE layer: the initial node representation and edge feature vectors are input into the GraphSAGE layer to generate the updated node representation.

[0121] Specifically, considering the relatively small data sample size, there is almost no impact on the runtime efficiency of the model between randomly sampling neighboring nodes and fully sampling neighboring nodes, but there is a significant impact on the information collected by the nodes. Therefore, in this case, this application performs full sampling of neighboring nodes.

[0122] like Figure 3 As shown, for each node, its neighboring nodes and corresponding edges are sampled, and the representations of the neighboring nodes and the edge features are aggregated to generate neighbor aggregation information, as shown in formula (5):

[0123] ; (5)

[0124] in, For the first Sampling neighborhood of the layer At the node Neighbor aggregation information; It is an aggregate function; For the first Layer nodes The representation of; For the first Layer nodes Edge connected to sampling node The representation of; For sampling neighborhood The sampling edge in.

[0125] In some embodiments, a Leaky ReLU activation function is added to each layer of the GraphSAGE layer for nonlinear transformation; a Dropout layer is applied after the GraphSAGE layer to prevent the model from overfitting.

[0126] The neighbor aggregation information is concatenated with the representation of the current node, and a new node representation is generated by performing a nonlinear transformation using the Leaky ReLU activation function, as shown in formula (6):

[0127] ; (6)

[0128] in, For the first Layer nodes The representation of; It is a non-linear activation function; For the first Layer weights; Aggregate information for neighbors.

[0129] In some embodiments, two GraphSAGE layers are used, namely =2, each node aggregates data from its neighbors in two hop counts, the hidden unit size of each layer is set to 128, the Dropout probability is 0.2, and the detection model structure based on the above parameters is as follows: Figure 4 As shown.

[0130] In the classification layer: the representations of the source node and the target node are concatenated, a linear transformation is used to generate the classification score of the edge, and the softmax function is used to calculate the probability of each edge belonging to each category.

[0131] Specifically, a multilayer perceptron (MLP) predictor is used, which applies a linear transformation to the data using a linear function. The output of the linear function is called the feature representation vector, and the initialization of the linear layer is shown in equation (7):

[0132] ; (7)

[0133] in, The weights of the linear layer; It is the space of real numbers; The dimension of the input features; This represents the number of output classes. Specifically, formula (7) represents the linear layer weight matrix. initialization form, It is a real matrix with rows. That is, the input feature is a concatenation of the source node and target node representations, and the number of columns is , which represents the number of output categories.

[0134] Calculate the prediction score for each network flow, as shown in formulas (8) and (9):

[0135] ; (8)

[0136] ; (9)

[0137] in, For the source node The feature vector, that is, the final representation of the source node after processing by the GraphSAGE layer; For the target node The feature vector, that is, the final representation of the target node after processing by the GraphSAGE layer; The weights of the linear layer; This indicates that the predicted score vector is a real number vector with a length equal to the number of output classes. ; express and It is a real number vector, the length of which is the dimension of the input features. .

[0138] In step S1033, the initial detection model is trained using a network traffic dataset; the loss between the classification result and the true classification label is constructed, and the initial detection model is optimized with the goal of minimizing the loss, and finally the detection module is trained.

[0139] In some embodiments, the cross-entropy function is used as the loss function, and the calculation formula is shown in Equation (10):

[0140] ; (10)

[0141] in, The loss between the classification result and the true classification label; Indicates the number of categories; These are real category tags; This is the classification result.

[0142] In some embodiments, Adam is used as the training optimizer to optimize the training of the detection model. Adam is an incremental optimization algorithm based on adaptive moment estimation of low-order moments of a stochastic objective function. It progressively optimizes the model parameters and reduces the value of the loss function. It is an effective stochastic optimization method that only requires a first-order gradient and a small amount of memory. The parameter update calculation formula based on Adam is shown in Equation (11):

[0143] ; (11)

[0144] in, for Detect model parameters at any time; The learning rate; and These are the first and second moments of the gradient, respectively; It is a constant.

[0145] The traffic relationship graph constructed in step S101 and the edge feature vector constructed in step S102 are input into the detection model trained based on steps S1031~S1033 to finally generate the classification result of the network traffic to be detected.

[0146] The lightweight network attack traffic detection method based on graph neural networks provided in this application will be further described below with reference to a specific embodiment.

[0147] The publicly available CICDDOS 2019 dataset, MQTT-IoT-IDS 2020 dataset, and CICIoT 2023 dataset were used as the network traffic dataset.

[0148] Perform class rebalancing, sample reduction, feature processing, and missing value removal on the network traffic dataset.

[0149] Detailed information about the network traffic dataset is shown in Table 2.

[0150] Table 2 Network Traffic Dataset Information

[0151]

[0152] Based on the training methods described in steps S1031-S1033 above, the final detection module is obtained by training using a network traffic dataset. In this embodiment, the detection module provided by this application is compared with the existing ERNN model, E-GraphSAGE model, and FS-Net model, and it is found that the detection module provided by this application has higher classification efficiency, classification accuracy, and superior classification performance.

[0153] Corresponding to the above method, the present invention also provides a lightweight network attack traffic detection system based on graph neural networks, the system comprising:

[0154] The graph construction module is used to obtain the network traffic to be detected and construct a traffic relationship graph with the IP address and port number of the network traffic as nodes and the network flow as edges.

[0155] The feature extraction module is used to extract multi-dimensional features from network traffic and perform standardization processing to construct edge feature vectors.

[0156] The detection module includes a detection model pre-trained based on steps S1031 to S1033. This detection model uses the GraphSAGE model to generate classification results of the network traffic to be detected based on the traffic relationship graph and edge feature vectors.

[0157] Corresponding to the above method, the present invention also provides an electronic device including a computer device, the computer device including a processor and a memory, the memory storing computer instructions, the processor executing the computer instructions stored in the memory, and when the computer instructions are executed by the processor, the electronic device performs the steps of the method as described above.

[0158] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned edge computing server deployment method. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of storage medium known in the art.

[0159] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the desired tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried in a carrier wave.

[0160] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0161] In this invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0162] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations of the embodiments of the present invention are possible. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A lightweight network attack traffic detection method based on graph neural networks, characterized in that, The method includes the following steps: Obtain the network traffic to be detected, and construct a traffic relationship graph using tuples of destination IP addresses and port numbers of the network traffic as nodes and network flows as edges; Multidimensional features are extracted from the network traffic and standardized to construct edge feature vectors; the multidimensional features include at least packet features, flow features, and statistical features. The traffic relationship graph and the edge feature vector are input into the pre-trained detection model to generate the classification result of the network traffic to be detected; wherein, the detection model adopts the GraphSAGE model, which aggregates the information of nodes and edges through a message passing mechanism to generate the classification result of each edge; The message passing mechanism includes: for each node, sampling all its neighboring nodes and corresponding edges; aggregating the representations of the neighboring nodes and edge features to generate neighbor aggregation information; concatenating the neighbor aggregation information with the representation of the current node and generating a new node representation through a nonlinear transformation; for each edge, concatenating the node representations at both ends and generating a classification score for the edge through a linear transformation. The neighbor aggregation information satisfies the following formula: ； in, For the first Sampling neighborhood of the layer At the node Neighbor aggregation information; It is an aggregate function; For the first Layer nodes The representation of; For the first Layer nodes Edge connected to sampling node The representation of; For sampling neighborhood Sampling edges in; The new node represents a node that satisfies the following formula: ； in, For the first Layer nodes The representation of; It is a non-linear activation function; For the first Layer weights; Aggregate information for the neighbors.

2. The lightweight network attack traffic detection method based on graph neural networks according to claim 1, characterized in that, Multidimensional features are extracted from the network traffic and standardized to construct edge feature vectors, including: Calculate the mean and standard deviation of the extracted features to determine the standardized eigenvalues. The formula is as follows: ； in, For the standardized processing of the first The first edge One eigenvalue; Before standardization processing The first edge One eigenvalue; For the first The mean of each feature; For the first The standard deviation of each feature.

3. The lightweight network attack traffic detection method based on graph neural networks according to claim 1, characterized in that, The detection model uses the GraphSAGE model, which includes an input layer, a GraphSAGE layer, and a classification layer. The flow relationship graph and the edge feature vector are input into the input layer to generate the initial node representation; The initial node representation and the edge feature vector are input into the GraphSAGE layer to generate the updated node representation; The updated node representation is input into the classification layer, and for each edge, the node representations at its two ends are concatenated. The concatenated node representation is linearly transformed to generate edge classification scores; based on the classification scores, the probability of each edge belonging to each category is calculated to obtain the final classification result.

4. The lightweight network attack traffic detection method based on graph neural networks according to claim 1, characterized in that, The training method for the detection model includes the following steps: Obtain a network traffic dataset, and construct a traffic relationship graph using the IP address and port number of each network traffic in the dataset as nodes and network flow as edges; extract multi-dimensional features from the network traffic dataset, perform standardization processing, and construct edge feature vectors. An initial detection model is constructed, which adopts the GraphSAGE model; The initial detection model is trained using the network traffic dataset. The traffic relationship graph and the edge feature vector are input into the initial detection model. The information of nodes and edges is aggregated through a message passing mechanism to generate the classification result of each edge. The loss between the classification result and the true classification label is constructed. The initial detection model is optimized with the goal of minimizing the loss, and finally the detection module is trained.

5. The lightweight network attack traffic detection method based on graph neural networks according to claim 4, characterized in that, Constructing the loss between the classification result and the true classification label includes: Using the cross-entropy function as the loss function, the calculation formula is: ； in, The loss between the classification result and the true classification label; Indicates the number of categories; The actual category label; The classification result is as described.

6. The lightweight network attack traffic detection method based on graph neural networks according to claim 4, characterized in that, Adam is used as the training optimizer to optimize the training of the detection model. The parameter update calculation formula is as follows: ； in, for Detect model parameters at any time; The learning rate; and These are the first and second moments of the gradient, respectively; It is a constant.

7. A lightweight network attack traffic detection system based on graph neural networks, characterized in that, The system includes: The graph construction module is used to obtain the network traffic to be detected, and construct a traffic relationship graph with the tuple of the destination IP address and port number of the network traffic as nodes and the network flow as edges. The feature extraction module is used to extract multi-dimensional features from the network traffic, perform standardization processing, and construct edge feature vectors. The detection module includes a pre-trained detection model, which employs the GraphSAGE model to generate classification results for the network traffic to be detected based on the traffic relationship graph and the edge feature vectors. The GraphSAGE model aggregates node and edge information through a message passing mechanism to generate a classification result for each edge. This message passing mechanism includes: for each node, fully sampling its neighboring nodes and corresponding edges; aggregating the representations of the neighboring nodes and edge features to generate neighbor aggregation information; concatenating the neighbor aggregation information with the representation of the current node; and generating a new node representation through a nonlinear transformation. For each edge, concatenating the node representations at both ends; and generating an edge classification score through a linear transformation. The neighbor aggregation information satisfies the following formula: ； in, For the first Sampling neighborhood of the layer At the node Neighbor aggregation information; It is an aggregate function; For the first Layer nodes The representation of; For the first Layer nodes Edge connected to sampling node The representation of; For sampling neighborhood Sampling edges in; The new node represents a node that satisfies the following formula: ； in, For the first Layer nodes The representation of; It is a non-linear activation function; For the first Layer weights; Aggregate information for the neighbors.

8. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method as described in any one of claims 1 to 6.

Images