Non-cooperative network topology awareness and behavior identification system and method based on graph data

Abstract

The application relates to the technical field of network perception, in particular to a non-cooperative network topology perception and behavior identification system and method based on graph data, which comprises a time series graph representation module, a feature extraction module and a classification and identification module. The time series graph representation module extracts network connection information elements of a physical layer, a link layer and a network layer of a non-cooperative network by using a sampling time window, constructs a target network time series graph to represent the connection and topology structure of the target network. The feature extraction module extracts graph structure features in the time series graph and feature values of the physical layer, the link layer and the network layer. The classification and identification module constructs a self-encoding space-time sequence graph attention network to classify and identify the features of the target network. The application can quickly obtain the topology structure of the non-cooperative network and prepare to identify the behavior of the non-cooperative network.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network perception, in particular to a non-cooperative network topology perception and behavior identification system and method based on graph data. BACKGROUND

[0002] Cooperative network behavior identification is based on certain traffic collection authority, and network service data can be directly obtained, such as various application service end collected and converged user network communication data. The data is mostly plaintext data, is relatively pure, has certain semantic information, is simple to process, and the target network connection topology and behavior state can be directly obtained through known target network management protocols, network configurations and the like. The non-cooperative network does not have access, use and control right of the target network, and can only obtain traffic data of the non-cooperative network through some specific means, such as air interface wireless data, network gateway station, and transit data on a routing switcher. The data usually contains physical link layer data, is generally non-plaintext data, has more redundant data, is not pure, and needs to be extracted through a specific method to obtain the target network connection information, and on this basis, the target network is reconstructed and topology perception and behavior research is carried out. At present, the topology perception and behavior identification research of the non-cooperative network is still in the initial stage, and there is no mature processing flow and framework to be referred to. SUMMARY

[0003] The present application aims to solve the problem of topology perception and behavior classification and identification in a non-cooperative network, and proposes a non-cooperative network topology perception and behavior identification system and method based on graph data, which can quickly obtain the topology structure of the non-cooperative network and prepare to identify the behavior of the non-cooperative network.

[0004] To achieve the above-mentioned purpose, the technical scheme adopted is:

[0005] A non-cooperative network topology perception and behavior identification system based on graph data, comprising:

[0006] A time series graph representation module extracts network connection information elements of the physical layer, the link layer and the network layer of the non-cooperative network by using a sampling time window, and constructs a target network time series graph to represent the connection and topology structure of the target network;

[0007] A feature extraction module extracts graph structure features in the time series graph and physical layer, link layer and network layer feature values;

[0008] A classification and identification module constructs a self-encoding spatiotemporal sequence graph attention network to classify and identify the features of the target network.

[0009] According to the non-cooperative network topology perception and behavior identification system based on graph data, further, the time series graph representation module comprises a network connection element extraction submodule and a cross-layer node and edge information integration submodule, wherein:

[0010] a network communication element extraction submodule, which extracts communication information in a non-cooperative network physical layer, a link layer and a network layer, the communication information including node information and edge information;

[0011] a cross-layer node and edge information integration submodule, which, after the collected node identifiers are aligned, encodes the node identifiers using word2vec, integrates and compares the edge information with the edge information in the edge information pool, and integrates the communication information of the same node pairs; and the obtained node and edge information is supplemented into the node information pool and the edge information pool, respectively.

[0012] According to the non-cooperative network topology perception and behavior recognition system based on graph data, further, the feature extraction module comprises a graph structure feature extraction submodule and a communication layer feature extraction submodule, wherein:

[0013] the graph structure feature extraction submodule extracts the degree centrality, betweenness centrality, closeness centrality, feature vector centrality, node degree and edge weight of each node in the target network time series graph;

[0014] the communication layer feature extraction submodule extracts physical layer feature values, link layer feature values and network layer feature values, and the time series graph structure features jointly constitute a feature vector G0 with a time series graph size of (N, 9, L).

[0015] According to the non-cooperative network topology perception and behavior recognition system based on graph data, further, the self-encoding space-time sequence graph attention network comprises a spatial feature processing submodule, a time series feature processing submodule, a pre-training submodule, a model parameter optimization submodule one, a classifier submodule and a model parameter optimization submodule two, wherein:

[0016] the spatial feature processing submodule uses a dynamic graph attention network GATv2 to process the time series graph feature vector G0 to obtain feature values G1;

[0017] the time series feature processing submodule uses an LSTM network to process the time series graph feature values G1 output by the spatial feature processing submodule to obtain graph space-time feature values GL;

[0018] the pre-training submodule uses an LSTM encoder-decoder to process the graph space-time feature values GL to obtain feature values Ge, and then uses the decoder to obtain time series graph decoding feature values Gd;

[0019] the model parameter optimization submodule one calculates the error of Ge and Gd through a loss function, and optimizes the model parameters of the spatial feature processing submodule, the time series feature processing submodule and the pre-training submodule through an optimizer;

[0020] The classifier submodule obtains a classification feature vector after linear network layer processing of the last moment feature value of the encoder output feature value Ge.

[0021] The model parameter optimization submodule two optimizes the model parameters by calculating the loss value of the classification feature vector and the label value through the loss function.

[0022] Further, the application also proposes a non-cooperative network topology perception and behavior recognition method based on graph data, which is realized based on the non-cooperative network topology perception and behavior recognition system based on graph data as described above, and the method comprises:

[0023] Network connection information elements are extracted from the physical layer, the link layer and the network layer of the non-cooperative network by using a sampling time window, and a target network time sequence graph is constructed to represent the connection and topology structure of the target network.

[0024] The graph structure features in the time sequence graph and the feature values of the physical layer, the link layer and the network layer are extracted.

[0025] An auto-encoding space-time sequence graph attention network is constructed to classify and recognize the features of the target network.

[0026] According to the non-cooperative network topology perception and behavior recognition method based on graph data, further, the sampling time window adopts full coverage sampling or fixed time length sampling according to the computing resources, full coverage sampling is adopted to obtain the sampling time window when the computing resources are sufficient, and fixed time length sampling is adopted to obtain the sampling time window when the computing resources are limited; the number of sampling windows is obtained by using a sampling window number selection method based on the network node scale and the average communication time length estimation.

[0027] According to the non-cooperative network topology perception and behavior recognition method based on graph data, further, if full coverage sampling is adopted, the calculation formula of the sampling time window is:

[0028]

[0029] wherein, C i0 is the sampling start time of the i th time window, C ie is the sampling end time of the i th time window, T0 is the network traffic start time, T e is the network traffic end time, and k is the number of sampling windows.

[0030] If fixed time length sampling is adopted, the calculation formula of the sampling time window is:

[0031]

[0032] wherein, T L is the fixed sampling time length, and T is the connection time length.

[0033] According to the non-cooperative network topology perception and behavior identification method based on graph data of the application, further, the number of sampling windows is obtained by using the sampling window number selection method based on the network node scale and the average communication duration estimation, and the calculation formula is:

[0034]

[0035] Wherein, N is the estimated node scale of the target network, and T is the communication duration.

[0036] The above technical scheme has the beneficial effects that:

[0037] The application extracts non-cooperative network communication information elements by using the sampling time window, and on this basis, constructs a dynamic time sequence diagram of the target network representation, extracts the dynamic behavior characteristics of the target network, and constructs a self-encoding space-time sequence diagram attention network to classify and identify the dynamic characteristics of the target network, such as identifying the target network user behavior, APP traffic classification and network anomaly. The application not only uses network layer information, but also uses link layer and physical layer information for fusion representation to construct the target network characteristics, which improves the representation ability of the target network characteristic vector, so as to improve the classification accuracy of the target network behavior.

[0038] In the aspect of network threat positioning, by obtaining the target network topology structure and identifying the key nodes and links, the network active protection or early warning can be assisted. In addition, the application can also be applied to the topology perception and behavior identification of encrypted network data (target network behavior information can be obtained), and the topology perception and behavior identification of non-cooperative network in the case of target non-sensing. BRIEF DESCRIPTION OF DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the application, the drawings of the embodiments of the application will be briefly introduced below. Among them, the drawings are only used to show some embodiments of the application, and not to limit all embodiments of the application to this.

[0040] Figure 1 It is a flowchart of the non-cooperative network topology perception and behavior identification method based on graph data of the embodiment of the application;

[0041] Figure 2 It is a sampling data processing flowchart of the sampling time window of the embodiment of the application;

[0042] Figure 3 It is a non-cooperative network communication information element extraction flowchart of the embodiment of the application;

[0043] Figure 4 It is a time sequence diagram feature extraction flowchart of the embodiment of the application;

[0044] Figure 5 is a structural diagram of a self-encoding spatio-temporal sequence graph attention network according to an embodiment of the present application. DETAILED DESCRIPTION

[0045] Hereinafter, example schemes of embodiments of the present application will be clearly and completely described with reference to the accompanying drawings of specific embodiments of the present application. Unless otherwise defined, technical terms or scientific terms used in the present application should be understood as having their usual meanings understood by persons having ordinary skills in the art.

[0046] A non-cooperative network refers to a network in which network users, data, and devices do not interact with a sensing party, and the sensing party can only passively obtain data in the non-cooperative network through special means. Non-cooperative networks exist widely in reality, for example, third-party wireless communication networks widely exist in real space.

[0047] The embodiment discloses a non-cooperative network topology sensing and behavior identification system based on graph data, comprising a time sequence graph representation module, a feature extraction module, and a classification and identification module, wherein:

[0048] The time sequence graph representation module extracts network connection information elements of the physical layer, the link layer, and the network layer of the non-cooperative network by using a sampling time window, and constructs a target network time sequence graph to represent the connection and topology structure of the target network.

[0049] The feature extraction module extracts graph structure features in the time sequence graph and physical layer, link layer, and network layer feature values (extracts 9-dimension features of each node, including degree centrality, betweenness centrality, closeness centrality, eigenvector centrality, node degree, edge weight, physical layer features, link layer features, and network layer features), to obtain a feature vector G0 with a size of (N, 9, L), wherein N is the number of graph data nodes, the feature dimension of each node is 9, and L is the length of the time sequence graph.

[0050] The classification and identification module constructs a self-encoding spatio-temporal sequence graph attention network to classify and identify features of the target network.

[0051] The functions of each module will be explained in detail below.

[0052] The time sequence graph representation module comprises a network connection element extraction submodule and a cross-layer node and edge information integration submodule, wherein:

[0053] The network communication element extraction submodule extracts the communication information in the non-cooperative network physical layer, the link layer and the network layer. The network layer information includes: network layer node unique identification (IP frame main called IP address), network layer node communication data volume (edge communication volume calculation), network layer edge unique identification (edge identification calculation), network layer edge communication data flow (IP frame length indication), network layer edge communication time (IP frame timestamp), network layer edge calling node (node identification), network layer edge called node (node identification). The link layer information packet includes: link layer node unique identification (link ID number), link layer node communication data volume (edge communication volume calculation), link layer edge unique identification (edge identification calculation), link layer edge communication data flow (link frame length indication), link layer edge communication time (link frame timestamp), link layer edge calling node (node identification), link layer edge called node (node identification), link layer edge network node (network layer association calculation). The physical layer information includes: physical layer node unique identification (physical frame ID number), physical layer node communication data volume (edge communication volume calculation), physical layer edge unique identification (edge identification calculation), physical layer edge communication data volume (calculated from the link layer communication volume), physical layer edge communication time (physical frame timestamp), physical layer edge calling node (node identification), physical layer edge called node (node identification), physical layer edge link node (link layer association calculation).

[0054] The cross-layer node and edge information integration submodule encodes the node identification in the collected target network communication information after identification alignment using word2vec, that is, each node appearing in the network will have a unique code, and the node information appearing in each newly collected communication information element is input to the node encoder and obtains a unique code and is stored in the node information pool. At the same time, the edge information is fused and compared with the edge information in the edge information pool, and the communication information of the same node pair is integrated. The obtained node and edge information is supplemented to the node information pool and the edge information pool respectively, and the communication topology graph of the target network can be obtained. For example, the relevant information of the communication nodes and edges in the link layer and the network layer is collected, the communication nodes in the link layer and the communication nodes in the network layer are integrated and merged, and the edge information of the link layer and the network layer is integrated.

[0055] The feature extraction module includes a graph structure feature extraction submodule and a communication layer feature extraction submodule, wherein:

[0056] The graph structure feature extraction submodule extracts the degree centrality (DC) and betweenness centrality (BC) of each node in the target network time sequence graph. DC i DCi is the degree centrality of the ith node, which represents the degree to which the entire network is organized and operated around a node or a group of nodes, k i N represents the number of nodes), and betweenness centrality (BC) of each node in the target network time sequence graph. BCi Betweenness centrality of the ith node, indicating the control ability of the node for the transmission of information between node pairs in the network along the shortest path, n s i t g represents the number of paths connecting nodes s and t through node i and being the shortest path, st Closeness centrality (C) represents the number of shortest paths connecting nodes s and t), closeness centrality (C CC i Closeness centrality, reflecting the sum of the shortest paths from the node to all other nodes in the network, d i Closeness centrality (C) represents the average distance from node i to the rest of the points), eigenvector centrality (C C e (v i Eigenvector centrality, used to measure the importance of a node as a transmission bridge in the graph, A is the adjacency matrix, and λ is the eigenvalue corresponding to the adjacency matrix), node degree (D D i Degree of the ith node, reflecting the number of links, A is the adjacency matrix), edge weight (W W i Edge weight of the ith node, EN i The number of connecting edges of the ith node.

[0057] The communication layer feature extraction submodule extracts the proportion of each network layer node in the physical layer traffic in the graph data Phy i Physical layer feature value of the ith node, NT i Communication traffic of the ith node, PT is the physical node communication traffic), the proportion of the edges of the link layer node occupied by the communication edges of each network layer node (Lin i = ΣLin ip , Lin i Link layer feature value of the ith node, Lin ip The number of IP nodes contained in the link node), network layer node weight (NT NT i Communication traffic of the ith node.

[0058] The auto-encoding spatiotemporal sequence graph attention network includes a spatial feature processing submodule, a temporal feature processing submodule, a pre-training submodule, a model parameter optimization submodule one, a classifier submodule and a model parameter optimization submodule two, wherein:

[0059] The spatial feature processing submodule uses the dynamic graph attention network GATv2 to process the temporal graph feature vector G0 to obtain the feature value (N, M, L) G1, wherein M is the output feature value dimension of the GAT network.

[0060] a time sequence feature processing submodule, which uses an LSTM network to process the time sequence feature value G1 output by the spatial feature processing submodule, to obtain a graph time-space feature value (N, H, L) GL, wherein H is the hidden layer dimension of the LSTM network.

[0061] a pre-training submodule, which uses an LSTM encoder-decoder to process the graph time-space feature value GL, to obtain a feature value (N, E, L) Ge, wherein E is the output dimension of the encoder, and then obtains a time sequence graph decoding feature value (N, H, L) Gd through the decoder.

[0062] a first model parameter optimization submodule, which calculates the error of Ge and Gd through a loss function, and optimizes the model parameters of the spatial feature processing submodule, the time sequence feature processing submodule and the pre-training submodule through an optimizer, so that the parameters of the spatial feature processing submodule, the time sequence feature processing submodule and the pre-training submodule can converge in the correct direction.

[0063] a classifier submodule, which obtains a classification feature value (N, F) through a linear network layer from the last time feature value of the encoder output feature value Ge, and then obtains a classification feature vector (1, F) through average processing, wherein F is the category of the classification target, including but not limited to target network user behavior (including chat, email, file transfer, video, voice interaction, etc.), APP traffic classification (including Aim, email, Facebook, ftp, Gmail, Hangout, Icq, Netflix, scp, sftp, skype, spotify, vimeo, youtube, etc.), and network anomaly (including abnormal chat connection, email connection, file transfer, etc. abnormal network behavior, and abnormal app traffic, etc.).

[0064] a second model parameter optimization submodule, which calculates the loss value of the classification feature vector and the label value through a loss function, and optimizes the model parameters, including the spatial feature processing submodule, the time sequence feature processing submodule, the pre-training submodule and the classifier submodule.

[0065] Based on the above-mentioned non-cooperative network topology perception and behavior recognition system based on graph data, as shown in Figure 1 The embodiment also discloses a non-cooperative network topology perception and behavior recognition method based on graph data, comprising the following steps:

[0066] In step S1, the time sequence graph representation module extracts network connection information elements of the physical layer, the link layer and the network layer of the non-cooperative network by using a sampling time window, so that the original connection information of the target network is preserved, and the influence of large-scale data return on the normal communication of the target network is avoided.

[0067] Step S2, constructing a target network timing diagram: after the cross-layer information element integration, the communication information elements extracted in step S101 are used to construct a target network representation timing diagram.

[0068] Step S3, extracting the graph structure features and physical layer, link layer and network layer feature values in the timing diagram using the feature extraction module.

[0069] Step S4, model classification training, comparing the output classification feature vector of the self-encoding space-time sequence diagram attention network with the label value to optimize and obtain the classification model of recognition classification.

[0070] Step S5, using the trained classification model to classify and identify the non-cooperative network features to obtain the correct classification result.

[0071] As shown in Figure 2 , the network communication information elements of the physical layer, link layer and network layer of the non-cooperative network are extracted using a sampling time window, which includes the following steps:

[0072] Step S101, determine the appropriate sampling time window and the number of sampling windows.

[0073] The sampling time window is calculated based on the computing resources using full coverage sampling or fixed duration sampling. When the computing resources are sufficient, full coverage sampling is used to obtain the sampling time window. When the computing resources are limited, fixed duration sampling is used to obtain the sampling time window.

[0074] If full coverage sampling is used, the calculation formula of the sampling time window is:

[0075]

[0076] Where C i0 is the starting time of the i-th sampling window, C ie is the end time of the i-th sampling window, T0 is the start time of the network traffic, T e is the end time of the network traffic, and k is the number of sampling windows.

[0077] If fixed duration sampling is used, the calculation formula of the sampling time window is:

[0078]

[0079] Where T L is the fixed sampling duration, T is the communication duration.

[0080] In these two sampling modes, the number of sampling windows k has a great influence on information acquisition. The present scheme proposes a sampling window number selection method based on network node scale and average communication duration estimation, that is:

[0081]

[0082] Wherein, N is the target network estimated node size, T is the duration of communication.

[0083] Step S102, using the sampling time window respectively samples the physical layer, link layer, network layer information of the target network.

[0084] Step S103, integrating the node and edge information in different network levels, a target network timing diagram is constructed.

[0085] In the non-cooperative network, there are usually multiple node identification information such as IP address, MAC address, IMSI, MSISDN, GT, etc. Compared with the existing topology awareness method based on network layer information with ip as the identification, the number of topology nodes and edges obtained after introducing the link layer and the physical layer is greatly increased, providing additional information elements for topology restoration. As shown in the figure, after the association mapping of various node identifications, the word2vec method is used to uniformly encode various node identifications, and the edge information is fused and compared with the existing edge information, and the communication information of the same node pair is integrated. The obtained node and edge information is supplemented to the node information pool and the edge information pool respectively. Figure 3

[0086] As shown in the figure, the target network timing diagram feature extraction process is as follows: Figure 4

[0087] Step S301, extracting the graph structure features of the target network timing diagram, including degree centrality, betweenness centrality, closeness centrality, feature vector centrality, node degree, edge weight, obtaining (N, 6, L) feature vector.

[0088] Step S302, integrating the physical layer feature value, the link layer feature value and the network layer feature value, obtaining (N, 3, L) feature vector, and the timing diagram structure feature together constitutes the timing diagram feature vector G0 with size (N, 9, L).

[0089] As shown in the figure, the specific process of step S4 is as follows: Figure 5

[0090] Step S401, using the dynamic graph attention network GATv2 to process the timing diagram feature vector G0, obtaining the feature value (N, M, L) G1, wherein M is the output feature value dimension of the GAT network.

[0091] Step S402, using the LSTM network to process the timing diagram feature value G1 output by the spatial feature processing submodule, obtaining the graph space-time feature value (N, H, L) GL, wherein H is the hidden layer dimension of the LSTM network.

[0092] ​​​Step S403, processing the graph spatio-temporal feature value GL using the LSTM encoder-decoder to obtain a feature value (N, E, L) Ge, wherein E is the output dimension of the encoder, and then obtaining a time series graph decoding feature value (N, H, L) Gd through the decoder.

[0093] Step S404, calculating the error of Ge and Gd through the loss function, and optimizing the model parameters of the spatial feature processing submodule, the time series feature processing submodule and the pre-training submodule through the optimizer, so that the parameters of the spatial feature processing submodule, the time series feature processing submodule and the pre-training submodule can converge in the correct direction.

[0094] Step S405, obtaining a classification feature value (N, F) through a linear network layer from the last time feature value of the encoder output feature value Ge, and then obtaining a classification feature vector (1, F) through average processing, wherein F is the category of the classification target, for example, including but not limited to target network user behavior (including chat, email, file transfer, video, voice interaction, etc.), APP traffic classification (including Aim, email, Facebook, ftp, Gmail, Hangout, Icq, Netflix, scp, sftp, skype, spotify, vimeo, youtube, etc.), and network anomaly (including abnormal chat connection, email connection, file transfer, etc. Abnormal network behavior, and abnormal app traffic, etc.).

[0095] Step S406, calculating the loss value of the classification feature vector and the label value through the loss function, and optimizing the model parameters, including the spatial feature processing submodule, the time series feature processing submodule, the pre-training submodule and the classifier submodule.

[0096] Unless specifically stated otherwise, the components, steps, numerical expressions and values set forth in these embodiments do not limit the scope of the present application.

[0097] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the system disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method part.

[0098] The units and method steps of each example described in combination with the embodiments disclosed herein can be realized in electronic hardware, computer software, or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described above in functional terms. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation does not exceed the scope of the present application.

[0099] Those skilled in the art can understand that all or part of the steps in the above method can be instructed by a program to complete the relevant hardware, and the program can be stored in a computer readable storage medium, such as a read-only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps of the above embodiments can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiments can be implemented in the form of hardware or in the form of a software function module. The present application is not limited to any specific form of combination of hardware and software.

[0100] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present application, which are used to illustrate the technical solutions of the present application, rather than limit them. The protection scope of the present application is not limited thereto, and although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some of the technical features within the technical scope disclosed by the present application; and these modifications or replacements do not cause the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A non-cooperative network topology awareness and behavior identification system based on graph data, characterized in that, The method comprises the following steps: a time sequence diagram characterization module extracts network connection information elements in a physical layer, a link layer and a network layer of a non-cooperative network by using a sampling time window, and constructs a target network time sequence diagram to characterize the connection and topology structure of the target network; the time sequence diagram characterization module comprises a network connection element extraction submodule and a cross-layer node and edge information integration submodule; the network connection element extraction submodule extracts connection information in the physical layer, the link layer and the network layer of the non-cooperative network, and the connection information comprises node information and edge information; the cross-layer node and edge information integration submodule encodes the collected node identifiers by using word2vec after alignment of the identifiers, integrates and compares the edge information with edge information in an edge information pool, and integrates the connection information of the same node pairs; the obtained node and edge information is supplemented into a node information pool and an edge information pool, respectively; a feature extraction module extracts graph structure features in the time sequence diagram and physical layer, link layer and network layer feature values; the feature extraction module comprises a graph structure feature extraction submodule and a communication layer feature extraction submodule; the graph structure feature extraction submodule extracts degree centrality, betweenness centrality, closeness centrality, feature vector centrality, node degree and edge weight of each node in the target network time sequence diagram; the communication layer feature extraction submodule extracts physical layer feature values, link layer feature values and network layer feature values, and the communication layer feature extraction submodule and the graph structure features jointly constitute a feature vector G0 of the time sequence diagram with a size of (N, 9, L), wherein N is the number of graph data nodes, 9 is the feature dimension of each node, and L is the length of the time sequence diagram; a classification and identification module processes the time sequence diagram feature vector G0 by using a dynamic graph attention network GATv2 to obtain a feature value G1, processes the time sequence diagram feature value G1 output by a spatial feature processing submodule by using an LSTM network to obtain a graph space-time feature value GL, and constructs a self-encoding space-time sequence graph attention network based on the graph space-time feature value GL to classify and identify the features of the target network.

2. The graph data based non-cooperative network topology aware and behavior identification system according to claim 1, wherein, The self-encoding space-time sequence graph attention network comprises a spatial feature processing submodule, a time sequence feature processing submodule, a pre-training submodule, a model parameter optimization submodule one, a classifier submodule and a model parameter optimization submodule two, wherein: the spatial feature processing submodule processes the time sequence diagram feature vector G0 by using the dynamic graph attention network GATv2 to obtain the feature value G1; the time sequence feature processing submodule processes the time sequence diagram feature value G1 output by the spatial feature processing submodule by using the LSTM network to obtain the graph space-time feature value GL; the pre-training submodule processes the graph space-time feature value GL by using an LSTM encoder-decoder to obtain a feature value Ge, and then obtains a time sequence diagram decoding feature value Gd by using the decoder; the model parameter optimization submodule one calculates an error of Ge and Gd by using a loss function, and optimizes model parameters of the spatial feature processing submodule, the time sequence feature processing submodule and the pre-training submodule by using an optimizer; the classifier submodule obtains a classification feature vector by using a linear network layer on the last time feature value of the encoder output feature value Ge; the model parameter optimization submodule two calculates a loss value of the classification feature vector and a label value by using a loss function, and optimizes the model parameters.

3. A method for non-cooperative network topology awareness and behavior identification based on graph data, characterized in that, The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of:

4. The method of claim 3, wherein, The method comprises the following steps of:

5. The method of claim 4, wherein, The method comprises the following steps of: wherein, C i0 is a sampling start time of the first i time window, C ie is a sampling end time of the first i time window, T 0 is a network traffic start time, T e is a network traffic end time, k is a number of sampling windows. The method comprises the following steps of: wherein, T L is a fixed sampling duration, , T is a communication duration.

6. The method of claim 5, wherein, The method comprises the following steps of: wherein, N is the target network estimated node size, T is the communication duration.

7. A computer apparatus comprising a memory, a processor, and a computer program stored on the memory, wherein the computer program, when executed by the processor, causes the processor to perform the method of any one of claims 1 to 6. The method comprises the following steps of:

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method comprises the following steps of: The method

Images