Non-cooperative network topology awareness and behavior recognition system and method based on graph data

Abstract

The invention relates to the technical field of network awareness, in particular to a non-cooperative network topology awareness and behavior recognition system and method based on graph data, and the system comprises a time sequence graph representation module, a feature extraction module and a classification recognition module. The time sequence diagram characterization module is used for extracting network communication information elements from a physical layer, a link layer and a network layer of the non-cooperative network by using a sampling time window, and constructing a target network time sequence diagram to characterize the communication and topological structure of a target network; the feature extraction module is used for extracting graph structure features in the time sequence graph and feature values of a physical layer, a link layer and a network layer; and the classification and recognition module is used for constructing a self-encoding space-time sequence diagram attention network to classify and recognize target network features. According to the method, the non-cooperative network topology structure can be quickly obtained, and non-cooperative network behaviors can be prepared to be identified.

Description

Technical Field

[0001] The present invention relates to the field of network perception technology, and in particular to a non-cooperative network topology perception and behavior recognition system and method based on graph data. Background Art

[0002] Cooperative network behavior identification is based on certain traffic collection permissions, and can directly obtain network business data, such as user network communication data collected by various application servers. Most of them are plain text data, which are relatively pure, have certain semantic information, and are simple to process. The communication topology and behavior status of the target network can be directly obtained through known target network management protocols, network configurations and other data. Non-cooperative networks, on the other hand, do not have access to, use and control over the target network, and can only obtain traffic data of non-cooperative networks through some specific means, such as air interface wireless data, network gateway stations, routing switches and other equipment. This type of data usually contains physical link layer data, which is generally non-plain text data, with more data redundancy and impurity. It is necessary to extract the target network communication information through specific methods, and reconstruct the target network on this basis and carry out topology perception and behavior research. At present, the research on topology perception and behavior identification of non-cooperative networks is still in its infancy, and there is no mature processing flow and framework to learn from. Summary of the invention

[0003] The present invention aims to solve the problems of topology perception and behavior classification and recognition in non-cooperative networks, and proposes a non-cooperative network topology perception and behavior recognition system and method based on graph data, which can quickly obtain the non-cooperative network topology structure and prepare to identify non-cooperative network behavior.

[0004] To achieve the above purpose, the technical solution adopted is:

[0005] A non-cooperative network topology perception and behavior recognition system based on graph data, comprising:

[0006] The timing diagram characterization module uses the sampling time window to extract network communication information elements from the physical layer, link layer and network layer of the non-cooperative network, and constructs the target network timing diagram to characterize the communication and topological structure of the target network;

[0007] Feature extraction module, extracting graph structure features in the timing graph as well as physical layer, link layer and network layer feature values;

[0008] The classification and recognition module constructs a self-encoding spatiotemporal sequence graph attention network to classify and recognize the target network features.

[0009] According to the non-cooperative network topology perception and behavior recognition system based on graph data of the present invention, further, the time sequence graph representation module includes a network communication element extraction submodule and a cross-layer node and edge information integration submodule, wherein:

[0010] The network communication element extraction submodule extracts the communication information in the physical layer, link layer and network layer of the non-cooperative network, and the communication information includes node information and edge information;

[0011] The cross-layer node and edge information integration submodule uses word2vec to encode the collected node identifiers after identifier alignment, and at the same time fuses and compares the edge information with the edge information in the edge information pool to integrate the communication information of the same node pairs; the obtained node and edge information are added to the node information pool and edge information pool respectively.

[0012] According to the non-cooperative network topology perception and behavior recognition system based on graph data of the present invention, further, the feature extraction module includes a graph structure feature extraction submodule and a communication layer feature extraction submodule, wherein:

[0013] The graph structure feature extraction submodule extracts the degree centrality, betweenness centrality, closeness centrality, eigenvector centrality, node degree and edge weight of each node in the target network time series graph;

[0014] The communication layer feature extraction submodule extracts the physical layer feature values, link layer feature values ​​and network layer feature values, and together with the timing graph structural features, they form a feature vector G0 of the timing graph with a size of (N, 9, L).

[0015] According to the non-cooperative network topology perception and behavior recognition system based on graph data of the present invention, further, the self-encoding spatiotemporal sequence graph attention network includes a spatial feature processing submodule, a temporal feature processing submodule, a pre-training submodule, a model parameter optimization submodule 1, a classifier submodule and a model parameter optimization submodule 2, wherein:

[0016] The spatial feature processing submodule uses the dynamic graph attention network GATv2 to process the temporal graph feature vector G0 and obtain the feature value G1;

[0017] The time series feature processing submodule uses the LSTM network to process the time series graph feature value G1 output by the spatial feature processing submodule to obtain the graph spatiotemporal feature value GL;

[0018] The pre-training submodule uses the LSTM encoder and decoder to process the graph spatiotemporal eigenvalue GL to obtain the eigenvalue Ge, and then obtains the time-series graph decoding eigenvalue Gd through the decoder;

[0019] Model parameter optimization submodule 1, calculates the error between Ge and Gd through the loss function, and optimizes the model parameters of the spatial feature processing submodule, the temporal feature processing submodule and the pre-training submodule through the optimizer;

[0020] The classifier submodule obtains the classification feature vector by passing the last moment feature value of the encoder output feature value Ge through a linear network layer;

[0021] Model parameter optimization submodule 2 calculates the loss value of the classification feature vector and the label value through the loss function to optimize the model parameters.

[0022] Furthermore, the present invention also proposes a non-cooperative network topology perception and behavior recognition method based on graph data, which is implemented based on the above-mentioned non-cooperative network topology perception and behavior recognition system based on graph data, and the method includes:

[0023] The sampling time window is used to extract network communication information elements from the physical layer, link layer and network layer of the non-cooperative network, and a target network timing diagram is constructed to characterize the communication and topological structure of the target network.

[0024] Extract graph structure features and physical layer, link layer and network layer feature values ​​in timing graphs;

[0025] Construct a self-encoding spatiotemporal sequence graph attention network to classify and identify target network features.

[0026] According to the non-cooperative network topology perception and behavior recognition method based on graph data of the present invention, further, the sampling time window adopts full coverage sampling or fixed duration sampling according to computing resources. When computing resources are sufficient, full coverage sampling is adopted to obtain the sampling time window, and when computing resources are limited, fixed duration sampling is adopted to obtain the sampling time window; the number of sampling windows is obtained by using a sampling window number selection method based on the network node scale and the average connection time estimation.

[0027] According to the non-cooperative network topology perception and behavior recognition method based on graph data of the present invention, further, if full coverage sampling is adopted, the calculation formula of the sampling time window is:

[0028]

[0029] Among them, C i0 is the sampling start time of the i-th time window, C ie is the sampling end time of the i-th time window, T0 is the network traffic start time, T e is the end time of network traffic, k is the number of sampling windows;

[0030] If fixed-duration sampling is used, the calculation formula for the sampling time window is:

[0031]

[0032] Among them, T L is a fixed sampling duration, T is the communication duration.

[0033] According to the non-cooperative network topology perception and behavior recognition method based on graph data of the present invention, further, the number of sampling windows is obtained by using a sampling window number selection method based on network node scale and average connection time estimation, and the calculation formula is:

[0034]

[0035] Among them, N is the estimated node size of the target network, and T is the communication duration.

[0036] The beneficial effects achieved by adopting the above technical solution are:

[0037] The present invention uses a sampling time window to extract non-cooperative network communication information elements, and on this basis constructs a dynamic time sequence diagram representing the target network, extracts the dynamic behavior characteristics of the target network, and constructs a self-encoded spatiotemporal sequence diagram attention network to classify and identify the dynamic characteristics of the target network, such as identifying the target network user behavior, APP traffic classification, and network anomalies. The present invention not only uses network layer information, but also uses link layer and physical layer information for fusion representation to construct target network features, which improves the representation ability of the target network feature vector to improve the accuracy of target network behavior classification.

[0038] In terms of network threat location, by obtaining the target network topology and identifying key nodes and links, it can assist in active network protection or early warning. In addition, the present invention can also be applied to the topology perception and behavior recognition of encrypted network data (which can obtain target network behavior information), and realize the topology perception and behavior recognition of non-cooperative networks without the target being aware of it. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings of the embodiments of the present invention, wherein the drawings are only used to illustrate some embodiments of the present invention, but not to limit all embodiments of the present invention thereto.

[0040] Figure 1 It is a flowchart of a non-cooperative network topology perception and behavior recognition method based on graph data according to an embodiment of the present invention;

[0041] Figure 2 is a flow chart of sampling data processing in a sampling time window according to an embodiment of the present invention;

[0042] Figure 3 is a flowchart of extracting non-cooperative network communication information elements according to an embodiment of the present invention;

[0043] Figure 4 is a flow chart of feature extraction of a timing diagram according to an embodiment of the present invention;

[0044] Figure 5 It is a structural diagram of the self-encoding spatiotemporal sequence graph attention network of an embodiment of the present invention. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings of specific embodiments of the present invention to clearly and completely describe the exemplary scheme of the embodiment of the present invention. Unless otherwise defined, the technical terms or scientific terms used in the present invention should be the common meanings understood by people with ordinary skills in the field.

[0046] A non-cooperative network is a network where network users, data, and devices do not interact with the sensing party. The sensing party can only passively obtain data in the non-cooperative network through special means. Non-cooperative networks are widely present in reality, such as third-party wireless communication networks that are widely present in real space.

[0047] This embodiment discloses a non-cooperative network topology perception and behavior recognition system based on graph data, including a time sequence graph representation module, a feature extraction module and a classification recognition module, wherein:

[0048] The timing diagram characterization module uses the sampling time window to extract network communication information elements from the physical layer, link layer and network layer of the non-cooperative network, and constructs the target network timing diagram to characterize the communication and topological structure of the target network.

[0049] The feature extraction module extracts the graph structure features and the characteristic values ​​of the physical layer, link layer and network layer in the timing graph (extracts features of 9 dimensions, including degree centrality, betweenness centrality, closeness centrality, eigenvector centrality, node degree, edge weight, physical layer features, link layer features and network layer features of each node), and obtains a feature vector G0 of size (N, 9, L), where N is the number of graph data nodes, the feature dimension of each node is 9, and L is the length of the timing graph.

[0050] The classification and recognition module constructs a self-encoding spatiotemporal sequence graph attention network to classify and recognize the target network features.

[0051] The functions of each module are explained in detail below.

[0052] The time-series graph representation module includes a network communication element extraction submodule and a cross-layer node and edge information integration submodule, where:

[0053] The network communication element extraction submodule extracts the communication information in the physical layer, link layer and network layer of the non-cooperative network. The network layer information includes: network layer node unique identification (IP frame calling and called IP addresses), network layer node communication data volume (edge ​​communication volume calculation), network layer edge unique identification (edge ​​identification calculation), network layer edge communication data flow (IP frame length indication), network layer edge communication time (IP frame timestamp), network layer edge calling node (node ​​identification), network layer edge called node (node ​​identification). Link layer information package: link layer node unique identification (link ID number), link layer node communication data volume (edge ​​communication volume calculation), link layer edge unique identification (edge ​​identification calculation), link layer edge communication data flow (link frame length indication), link layer edge communication time (link frame timestamp), link layer edge calling node (node ​​identification), link layer edge called node (node ​​identification), link layer edge network node (network layer association calculation). The physical layer information includes: physical layer node unique identification (physical frame ID number), physical layer node communication data volume (edge ​​communication volume calculation), physical layer edge unique identification (edge ​​identification calculation), physical layer edge communication data volume (calculated by link layer communication volume), physical layer edge communication time (physical frame timestamp), physical layer edge calling node (node ​​identification), physical layer edge called node (node ​​identification), physical layer edge link node (link layer association calculation).

[0054] The cross-layer node and edge information integration submodule uses word2vec to encode the node identifiers in the collected target network connection information after identifier alignment, that is, each node in the network will have a unique code. The newly appearing node information in each newly collected connection information element must be input into the node encoder and obtain the unique code and store it in the node information pool. At the same time, the edge information is fused and compared with the edge information in the edge information pool to integrate the connection information of the same node pair. The obtained node and edge information is added to the node information pool and the edge information pool respectively, and the connection topology of the target network can be obtained. For example, the relevant information of the connection nodes and edges of the link layer and the network layer are collected respectively, the connection nodes in the link layer are integrated and merged with the connection nodes in the network layer, and the edge information of the link layer and the network layer are integrated.

[0055] The feature extraction module includes a graph structure feature extraction submodule and a communication layer feature extraction submodule, where:

[0056] The graph structure feature extraction submodule extracts the degree centrality of each node in the target network time series graph ( DC i is the degree centrality of the ith node, indicating the degree to which the entire network is organized around a node or a group of nodes, k i represents the number of existing edges connected to node i, N represents the number of nodes), betweenness centrality ( BCi is the betweenness centrality of the ith node, which indicates the control ability of the node for transmitting information along the shortest path between node pairs in the network, n s i t represents the number of shortest paths connecting nodes s and t through node i, g st represents the number of shortest paths connecting nodes s and t), proximity centrality ( CC i To approximate centrality, it reflects the sum of the shortest paths from a node to all other nodes in the network, d i represents the average distance from node i to the rest of the points), eigenvector centrality ( C e (v i ) is the eigenvector centrality, which is used to measure the importance of a node as a transmission bridge in the graph, A is the adjacency matrix, λ is the eigenvalue corresponding to the adjacency matrix), node degree ( D i is the degree of the i-th node, reflecting the number of links of the node, A is the adjacency matrix), edge weight ( W i is the edge weight of the i-th node, EN i is the number of connected edges of the ith node).

[0057] The communication layer feature extraction submodule extracts the proportion of each network layer node in the physical layer communication volume in the graph data ( Phy i is the physical layer characteristic value of the i-th node, NT i is the communication flow of the ith node, PT is the communication flow of the physical node), the proportion of the communication edges of each network layer node to the edges of the link layer nodes (Lin i =ΣLin ip , Lin i is the link layer characteristic value of the i-th node, Lin ip is the number of IP nodes contained in the link node), network layer node weight ( NT i is the communication flow of the ith node).

[0058] The self-encoding spatiotemporal sequence graph attention network includes a spatial feature processing submodule, a temporal feature processing submodule, a pre-training submodule, a model parameter optimization submodule 1, a classifier submodule and a model parameter optimization submodule 2, among which:

[0059] The spatial feature processing submodule uses the dynamic graph attention network GATv2 to process the time-series graph feature vector G0 and obtain the eigenvalue (N, M, L) G1, where M is the dimension of the GAT network output eigenvalue.

[0060] The time series feature processing submodule uses the LSTM network to process the time series graph feature value G1 output by the spatial feature processing submodule to obtain the graph spatiotemporal feature value (N,H,L)GL, where H is the hidden layer dimension of the LSTM network.

[0061] The pre-training submodule uses the LSTM encoder-decoder to process the graph spatiotemporal eigenvalues ​​GL to obtain the eigenvalues ​​(N, E, L)Ge, where E is the encoder output dimension, and then the decoder obtains the time-series graph decoding eigenvalues ​​(N, H, L)Gd.

[0062] Model parameter optimization submodule 1 calculates the error between Ge and Gd through the loss function, and optimizes the model parameters of the spatial feature processing submodule, the temporal feature processing submodule and the pre-training submodule through the optimizer, so that the parameters of the spatial feature processing submodule, the temporal feature processing submodule and the pre-training submodule can converge in the right direction.

[0063] The classifier submodule obtains the last moment eigenvalue of the encoder output eigenvalue Ge through a linear network layer, and then obtains the classification eigenvalue (N, F) after averaging, where F is the type of classification target, such as but not limited to target network user behavior (including chat, email, file transfer, video, voice interaction, etc.), APP traffic classification (including Aim, email, Facebook, ftp, Gmail, Hangout, Icq, Netflix, scp, sftp, skype, spotify, vimeo, youtube, etc.) and network anomalies (including abnormal chat communication, email contact, file transfer and other abnormal network behaviors, as well as abnormal app traffic, etc.).

[0064] The second model parameter optimization submodule calculates the loss value of the classification feature vector and the label value through the loss function, and optimizes the model parameters, including the spatial feature processing submodule, the temporal feature processing submodule, the pre-training submodule and the classifier submodule.

[0065] Based on the above graph data-based non-cooperative network topology perception and behavior recognition system, such as Figure 1 As shown, this embodiment also discloses a non-cooperative network topology perception and behavior recognition method based on graph data, comprising the following steps:

[0066] Step S1, the timing diagram characterization module uses the sampling time window to extract network communication information elements from the physical layer, link layer and network layer of the non-cooperative network, so as to retain the original communication information of the target network and avoid the impact of large-scale data return on the normal communication of the target network.

[0067] Step S2, constructing a target network timing diagram: constructing a target network representation timing diagram by integrating the communication information elements extracted in step S101 with cross-layer information elements.

[0068] Step S3: Use a feature extraction module to extract graph structure features and physical layer, link layer and network layer feature values ​​in the timing graph.

[0069] Step S4, model classification training, compare and optimize the classification feature vector output by the self-encoding spatiotemporal sequence graph attention network with the label value to obtain a classification model for recognition classification.

[0070] Step S5: Use the trained classification model to classify and identify the non-cooperative network features to obtain correct classification results.

[0071] like Figure 2 As shown, using the sampling time window to extract network communication information elements from the physical layer, link layer and network layer of the non-cooperative network specifically includes the following steps:

[0072] Step S101: Determine an appropriate sampling time window and the number of sampling windows.

[0073] The sampling time window adopts full coverage sampling or fixed duration sampling according to the computing resources. When the computing resources are sufficient, the sampling time window is obtained by full coverage sampling. When the computing resources are limited, the sampling time window is obtained by fixed duration sampling.

[0074] If full coverage sampling is used, the calculation formula for the sampling time window is:

[0075]

[0076] Among them, C i0 is the sampling start time of the i-th time window, C ie is the sampling end time of the i-th time window, T0 is the network traffic start time, T e is the end time of network traffic, and k is the number of sampling windows.

[0077] If fixed-duration sampling is used, the calculation formula for the sampling time window is:

[0078]

[0079] Among them, T L is a fixed sampling duration, T is the communication duration.

[0080] In these two sampling modes, the number of sampling windows k has a great influence on the acquisition of information. This scheme proposes a method for selecting the number of sampling windows based on the network node scale and the average communication duration estimation, namely:

[0081]

[0082] Among them, N is the estimated node size of the target network, and T is the communication duration.

[0083] Step S102: Use the sampling time window to sample the physical layer, link layer, and network layer information of the target network respectively.

[0084] Step S103: Integrate the node and edge information in different network layers to construct a target network timing graph.

[0085] In non-cooperative networks, there are usually multiple node identification information such as IP address, MAC address, IMSI, MSISDN, GT, etc. Compared with the existing topology perception method based on network layer information with IP as the identifier, the number of topological nodes and edges obtained by this solution after introducing the link layer and physical layer is greatly increased, providing additional information elements for topology restoration. Figure 3 As shown in the figure, after various node identifiers are associated and mapped, the word2vec method is used to uniformly encode various node identifiers, and the edge information is fused and compared with the existing edge information to integrate the communication information of the same node pairs. The obtained node and edge information are added to the node information pool and edge information pool respectively.

[0086] like Figure 4 As shown in the figure, the feature extraction process of the target network timing diagram is as follows:

[0087] Step S301: extract the graph structure features of the target network timing graph, including degree centrality, betweenness centrality, closeness centrality, eigenvector centrality, node degree, and edge weight, and obtain a (N, 6, L) eigenvector.

[0088] Step S302: Integrate and extract the physical layer feature values, link layer feature values, and network layer feature values ​​to obtain a (N, 3, L) feature vector, which together with the timing graph structural features constitutes a feature vector G0 of a timing graph size of (N, 9, L).

[0089] like Figure 5 As shown, the specific process of step S4 is as follows:

[0090] Step S401: Use the dynamic graph attention network GATv2 to process the time series graph feature vector G0 to obtain the feature value (N, M, L) G1, where M is the dimension of the GAT network output feature value.

[0091] Step S402: Use the LSTM network to process the time-series graph feature value G1 output by the spatial feature processing submodule to obtain the graph spatiotemporal feature value (N, H, L) GL, where H is the hidden layer dimension of the LSTM network.

[0092] Step S403: Use the LSTM encoder and decoder to process the graph spatiotemporal eigenvalue GL to obtain the eigenvalue (N, E, L) Ge, where E is the encoder output dimension, and then obtain the timing graph decoding eigenvalue (N, H, L) Gd through the decoder.

[0093] Step S404, calculate the error between Ge and Gd through the loss function, and optimize the model parameters of the spatial feature processing submodule, the temporal feature processing submodule and the pre-training submodule through the optimizer, so that the parameters of the spatial feature processing submodule, the temporal feature processing submodule and the pre-training submodule can converge in the right direction.

[0094] Step S405, the last moment eigenvalue of the encoder output eigenvalue Ge is passed through a linear network layer to obtain a classification eigenvalue (N, F), and then the classification eigenvector (1, F) is obtained after averaging, where F is the type of classification target, such as but not limited to target network user behavior (including chat, email, file transfer, video, voice interaction, etc.), APP traffic classification (including Aim, email, Facebook, ftp, Gmail, Hangout, Icq, Netflix, scp, sftp, skype, spotify, vimeo, youtube, etc.) and network anomalies (including abnormal chat communication, email contact, file transfer and other abnormal network behaviors, as well as abnormal app traffic, etc.).

[0095] Step S406, calculating the loss value of the classification feature vector and the label value through the loss function, and optimizing the model parameters, including the spatial feature processing submodule, the temporal feature processing submodule, the pre-training submodule and the classifier submodule.

[0096] Unless otherwise specifically stated, the components, steps, numerical expressions and values ​​set forth in these embodiments do not limit the scope of the present invention.

[0097] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0098] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0099] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of combination of hardware and software.

[0100] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or replace some of the technical features therein by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A non-cooperative network topology perception and behavior recognition system based on graph data, characterized in that: include: The timing diagram characterization module uses the sampling time window to extract network communication information elements from the physical layer, link layer and network layer of the non-cooperative network, and constructs the target network timing diagram to characterize the communication and topological structure of the target network; Feature extraction module, extracting graph structure features in the timing graph as well as physical layer, link layer and network layer feature values; The classification and recognition module constructs a self-encoding spatiotemporal sequence graph attention network to classify and recognize the target network features.

2. The non-cooperative network topology perception and behavior recognition system based on graph data according to claim 1 is characterized in that: The time sequence graph representation module includes a network communication element extraction submodule and a cross-layer node and edge information integration submodule, wherein: The network communication element extraction submodule extracts the communication information in the physical layer, link layer and network layer of the non-cooperative network, and the communication information includes node information and edge information; The cross-layer node and edge information integration submodule uses word2vec to encode the collected node identifiers after identifier alignment, and at the same time fuses and compares the edge information with the edge information in the edge information pool to integrate the communication information of the same node pairs; the obtained node and edge information are added to the node information pool and edge information pool respectively.

3. The non-cooperative network topology perception and behavior recognition system based on graph data according to claim 1, characterized in that: The feature extraction module includes a graph structure feature extraction submodule and a communication layer feature extraction submodule, wherein: The graph structure feature extraction submodule extracts the degree centrality, betweenness centrality, closeness centrality, eigenvector centrality, node degree and edge weight of each node in the target network time series graph; The communication layer feature extraction submodule extracts the physical layer feature values, link layer feature values ​​and network layer feature values, and together with the timing graph structural features, they form a feature vector G0 of the timing graph with a size of (N, 9, L).

4. The non-cooperative network topology perception and behavior recognition system based on graph data according to claim 3 is characterized in that: The self-encoding spatiotemporal sequence graph attention network includes a spatial feature processing submodule, a temporal feature processing submodule, a pre-training submodule, a model parameter optimization submodule 1, a classifier submodule and a model parameter optimization submodule 2. in: The spatial feature processing submodule uses the dynamic graph attention network GATv2 to process the temporal graph feature vector G0 and obtain the feature value G1; The time series feature processing submodule uses the LSTM network to process the time series graph feature value G1 output by the spatial feature processing submodule to obtain the graph spatiotemporal feature value GL; The pre-training submodule uses the LSTM encoder and decoder to process the graph spatiotemporal eigenvalue GL to obtain the eigenvalue Ge, and then obtains the time-series graph decoding eigenvalue Gd through the decoder; Model parameter optimization submodule 1, calculates the error between Ge and Gd through the loss function, and optimizes the model parameters of the spatial feature processing submodule, the temporal feature processing submodule and the pre-training submodule through the optimizer; The classifier submodule obtains the classification feature vector by passing the last moment feature value of the encoder output feature value Ge through a linear network layer; Model parameter optimization submodule 2 calculates the loss value of the classification feature vector and the label value through the loss function to optimize the model parameters.

5. A non-cooperative network topology perception and behavior recognition method based on graph data, characterized in that: Based on the non-cooperative network topology perception and behavior recognition system based on graph data as described in any one of claims 1 to 4, the method includes: The sampling time window is used to extract network communication information elements from the physical layer, link layer and network layer of the non-cooperative network, and a target network timing diagram is constructed to represent the communication and topological structure of the target network. Extract graph structure features and physical layer, link layer and network layer feature values ​​in timing graphs; Construct a self-encoding spatiotemporal sequence graph attention network to classify and identify target network features.

6. The non-cooperative network topology perception and behavior recognition method based on graph data according to claim 5 is characterized in that: The sampling time window adopts full coverage sampling or fixed duration sampling according to computing resources. When computing resources are sufficient, full coverage sampling is adopted to obtain the sampling time window, and when computing resources are limited, fixed duration sampling is adopted to obtain the sampling time window. The number of sampling windows is obtained by using a sampling window number selection method based on network node scale and average connection time estimation.

7. The non-cooperative network topology perception and behavior recognition method based on graph data according to claim 6 is characterized in that: If full coverage sampling is used, the calculation formula for the sampling time window is: Among them, C i0 is the sampling start time of the i-th time window, C ie is the sampling end time of the i-th time window, T0 is the network traffic start time, T e is the end time of network traffic, k is the number of sampling windows; If fixed-duration sampling is used, the calculation formula for the sampling time window is: Among them, T L is a fixed sampling duration, T is the communication duration.

8. The non-cooperative network topology perception and behavior recognition method based on graph data according to claim 7 is characterized in that: The number of sampling windows is obtained by using the sampling window number selection method based on the network node scale and the average connection time estimation. The calculation formula is: Among them, N is the estimated node size of the target network, and T is the communication duration.

9. A computer device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method according to any one of claims 5 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 5 to 8 are implemented.

Images