A malicious traffic detection method based on hyperbolic space modeling and graph neural networks

Abstract

A malicious traffic detection method based on hyperbolic space modeling and graph neural network belongs to the field of network security, comprising: modeling network traffic data as a network threat graph; on this basis, a hyperbolic space and an attention mechanism are introduced to construct a Hyper-GraphSAGE model; the GraphSAGE algorithm is executed on the source node and the target node respectively, and the features of the two nodes are spliced to form the embedded representation of the traffic data, and finally classification processing is performed; the traffic data received by the server node is aggregated and processed, and the hyperbolic attention mechanism is used to calculate the similarity between different traffic packets. The present application combines hyperbolic geometry and graph neural network, enhances the abnormal detection capability of network traffic, especially for attack patterns in complex environments such as IoT network and Internet, and enhances the recognition ability and robustness of the system to different types of attacks.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a method for detecting malicious traffic based on hyperbolic space modeling and graph neural networks. Background Technology

[0002] Intrusion detection has become a new trend in the field of cybersecurity. Traditional network intrusion detection systems (IDS) aim to identify malicious activity in computer network traffic and issue alerts when suspicious activity is detected. While most traditional learning techniques, such as neural networks, fuzzy models, and hidden Markov algorithms, have achieved great success in IDS, they have limitations in handling large amounts of network traffic data due to their shallow architecture. Furthermore, traditional learning methods cannot be properly applied to complex classification problems due to their specific constraints. In contrast, deep learning models have demonstrated outstanding performance in large-scale data analysis. The application of deep learning models in network intrusion detection can be traced back to 2011, when Salama et al. proposed a hybrid intrusion detection scheme based on nonvariable analysis (Salama MA, Eid HF, Ramadan RA, et al. Hybrid intelligent intrusion detection scheme[C] / / Soft computing inindustrial applications. Springer Berlin Heidelberg, 2011:293-303.), combining DBN and SVM to classify network intrusions into normal outcomes and attack outcomes. DBN is built upon RBM layers as a feature reduction method, and then an SVM classifier is used. In early 2016, Kim et al. applied LSTM to RNN to construct the IDS model (J. Kim, J. Kim, H.L. Thu, et al. Long short term memory recurrent neural network classifier for intrusion detection [C] / / Proceedings of the 2016 International Conference on Platform Technology and Service (PlatCon), IEEE, 2016: 1-5.). The authors used softmax in the output layer and SGD as the optimizer. Through experiments with different values ​​and by selecting appropriate values, the learning rate and the size of the hidden layers were determined.Dong et al. combined different perspectives and implemented different ML methods on the KDD'99 dataset (B. Dong, X. Wang, Comparison deep learning method to traditional methods using for network intrusion detection [C] / / Proceedings of the 8th International Conference on Communication Software and Networks (ICCSN), IEEE, 2016: 581–585.) to classify network traffic and distinguish normal attacks, namely DOS, Probe, U2R and R2L.

[0003] Considering the significant impact of network topology on attack feature extraction, graph mining has become increasingly popular in IDS research. Current research on graph-based detection methods mainly focuses on two directions: constructing effective network traffic graph models and developing efficient graph analysis algorithms. Regarding the first direction, researchers have attempted to utilize different features to construct network traffic graphs, such as time-series features, protocol type features, and port number features. For example, pre-derived protocol host behaviors are stored in the form of a graph (Wang Zhaohui, Shen Huawei, Cao Qi, et al. A review of graph classification research [J]. Journal of Software, 2021, 33(1):171-192.), and protocol identification is achieved through graph matching, with an accuracy exceeding 95%. Xiao et al. transformed network flow into first-order and second-order graphs (Xiao Q, Liu J, Wang Q, et al. Towards networkanomaly detection using graph embedding[C] / / Computational Science–ICCS2020:20th International Conference,Amsterdam,The Netherlands,June 3–5,2020,Part IV20.Springer International Publishing,2020:156-169.). The first-order graph learns latent features from individual nodes, while the second-order graph learns features from a global perspective. Some studies have used graph convolutional neural networks (GCNs) to analyze structural information and detect P2P botnet nodes (Mo S, Wang Y, Xiao D, et al. Encrypted traffic classification using graph convolutional networks [C] / / Advanced Data Mining and Applications: 16th International Conference, ADMA 2020, Foshan, China, November 12–14, 2020, Springer International Publishing, 2020: 207-219.), but it cannot be used to detect other attacks.Lo W et al. improved the GraphSAGE (Graph Sample and Aggregation) algorithm and proposed an inductive algorithm for flow classification, E-GraphSAGE (Lo WW, Layeghy S, Sarhan M, et al. E-graphsage: A graph neural network-based intrusion detection system for iotf[C]. NOMS2022-2022IEEE / FIP NetworkOperations and Management Symposium.IEEE 2022:1-9.), making it suitable for edge classification tasks, but it did not handle the problem of imbalanced data very well.

[0004] Spaces with constant negative curvature are called hyperbolic spaces. The curvature at every point in a hyperbolic space is negative, meaning its geometric properties are completely different from Euclidean geometry. Spaces with negative curvature have an infinitely large area, and their volume grows rapidly with increasing radius. Their tree-like properties have been extensively studied and used to visualize large-scale classification methods (Mettes P, Ghadimi Atigh M, Keller-Ressel M, et al. Hyperbolic deep learning in computer vision: A survey[J]. International Journal of Computer Vision, 2024: 1-25.) or to embed heterogeneous complex networks (Mirvakhabova L, Frolov E, Khrulkov V, et al. Performance of hyperbolic geometry models on top-n recommendation tasks[C] / / Proceedings of the 14th ACM Conference on Recommender Systems. 2020: 527-532.). Recently in machine learning, hyperbolic representations have significantly outperformed Euclidean embeddings in hierarchical, categorical, or latent data (Yang M, Zhou M, Ying R, et al. Hyperbolic representation learning: Revisiting and advancing[C]. International Conference on Machine Learning. PMLR, 2023: 39639-39659.)(Jiang Y, Tabaghi ​​P, Mirarb S. Learning hyperbolic embedding for phylogenetic tree placement and updates[J]. Biology, 2022, 11(9): 1256.). Hyperbolic spaces have made significant progress in modeling hierarchical datasets due to their ability to efficiently encode tree structures (Zitnik M, R, Feldman MW, et al. Evolution of resilience in protein interactomes across the tree of life[C]. / / Proceedings of the National Academy of Sciences, 2019, 116(10):4426-4433.). Among its different isometric interpretations, the Poincaré sphere model is the most popular. It is a common representation of hyperbolic geometry and has been applied to the convolutional HGCN of Euclidean networks (Chami I, Ying Z, et al. Hyperbolic graph convolutional neural networks[J]. Advances in Neural Information Processing Systems, 2019, 32.). Hyperbolic geometry is a non-Euclidean geometry, a core characteristic of which is the negative curvature of its space, in contrast to the flat space of Euclidean geometry. The Poincaré sphere model embeds hyperbolic geometry within a finite sphere. This model provides an intuitive geometric representation of hyperbolic geometry and is easily integrated with modern computer graphics and machine learning methods. Furthermore, the hyperbolic space is modeled exponentially, providing ample space to represent rare data points. This space eliminates the interference of random noise on these data points, thus better handling data with long-tail effects.

[0005] Graph Neural Networks (GNNs) have become one of the fastest-growing subfields in machine learning. Their power lies in their ability to effectively utilize the graph structures inherent in many real-world applications, such as social media networks, biological systems, and telecommunications networks. A core task of GNNs is node embedding, which aims to encode nodes in a graph into low-dimensional vectors while preserving their key relationships and positions within the original graph. Node embedding is often a crucial prerequisite for subsequent tasks such as node classification and node clustering.

[0006] GraphSAGE (Graph Sample and Aggregation) is a commonly used deep learning model in graph neural networks for processing graph data, particularly suitable for learning node embeddings in large-scale graphs. The GraphSAGE algorithm efficiently learns a low-dimensional representation of each node by sampling and aggregating the neighborhood of the graph. Its core idea is to sample a certain number of neighboring nodes around each node in the graph, and then update the node's representation by aggregating the information from these neighboring nodes. This method avoids global computation across the entire graph in large-scale graphs, exhibiting good scalability.

[0007] In summary, existing network intrusion detection methods have the following technical problems:

[0008] 1. Insufficient Accuracy and Robustness: Traditional network intrusion detection systems (IDS) primarily rely on static rules, feature matching, or behavior-based analysis methods. These methods suffer from poor accuracy when faced with complex and dynamically changing network traffic. Particularly for attack patterns in large-scale networks (such as IoT networks and the Internet), these methods struggle to identify them efficiently. For example, complex malicious behaviors such as DDoS attacks and packet hijacking often exhibit highly diverse and unpredictable characteristics, leading to a high false negative rate for existing network intrusion detection methods.

[0009] 2. Lack of ability to model hierarchical network features: Most existing network intrusion detection methods rely on simple feature extraction methods, ignoring the complex relationships and hierarchical topology between different nodes in the network. Especially when facing large-scale, heterogeneous network environments such as IoT networks and the Internet, effectively modeling multi-hop dependencies and hierarchical structures between nodes becomes a challenge. Although graph neural network methods can effectively model the relationships between nodes, they still have performance bottlenecks when dealing with complex network traffic and multi-hop associations.

[0010] 3. Inefficient feature aggregation and information propagation: While traditional graph neural network methods (such as GraphSAGE) can aggregate features through neighborhood message passing, they often lose important information when modeling high-dimensional feature spaces and multi-hop dependencies. Furthermore, feature aggregation methods based on Euclidean space struggle to effectively capture the geometric structure and hierarchical characteristics of traffic data.

[0011] 4. Neglect of complex relationships between traffic flows: Traditional network traffic analysis methods often overlook the spatiotemporal correlations between traffic flows, especially in attack patterns involving multiple nodes and different traffic sources, where similarity calculation and correlation modeling between traffic flows are particularly important. Furthermore, traditional network traffic analysis methods suffer from inaccuracies and susceptibility to noise interference in calculating the correlations between traffic flows, leading to high false positive and false negative rates. Summary of the Invention

[0012] To address the problems of existing network intrusion detection methods, this invention provides a malicious traffic detection method based on hyperbolic space modeling and graph neural networks. The main objective of this invention is to improve the accuracy of anomaly detection in network traffic monitoring and intrusion detection by utilizing graph neural networks and hyperbolic geometric models, especially for large-scale and complex network environments (such as IoT networks and the Internet), addressing the challenges of multi-hop traffic correlation modeling and traffic feature aggregation.

[0013] This invention, by introducing a hyperbolic geometric model, can more efficiently and accurately capture potential attack patterns in network traffic, especially in complex network environments such as IoT networks and the Internet, enhancing the system's ability to identify and its robustness against different types of attacks (such as DDoS attacks and packet hijacking). Furthermore, by introducing hyperbolic space modeling, this invention can effectively capture the hierarchical structure and multi-hop dependencies between nodes in the network, improving the accuracy and robustness of existing methods in large-scale, complex networks.

[0014] The technical solution adopted by this invention to solve the technical problem is as follows:

[0015] This invention provides a malicious traffic detection method based on hyperbolic space modeling and graph neural networks, which specifically includes the following steps:

[0016] Step 1: Establish a hyperbolic attention mechanism;

[0017] Step 2: Transform the malicious traffic detection problem into a graph-based edge classification task. The graph-based edge classification task models network traffic data into a network threat graph.

[0018] Step 3: Based on the network threat graph, introduce hyperbolic space and attention mechanism to construct the Hyper-GraphSAGE model;

[0019] Step 4: Construct the Hyper-GraphSAGE-IoT algorithm for IoT networks; use this algorithm to execute the GraphSAGE algorithm on the source node and the target node respectively, and concatenate the features of the two nodes to form an embedded representation of the traffic data, and finally perform classification processing;

[0020] Step 5: Construct the Hyper-GraphSAGE-internet algorithm for the Internet; use this algorithm to aggregate the traffic data received by the server node, and use the hyperbolic attention mechanism to calculate the similarity between different traffic packets.

[0021] Furthermore, in step one, hyperbolic space modeling is first performed, mapping Euclidean features to the Poincaré sphere B. n , that is, X B =exp(X R ), X R ={x1,x2,…,x n} represents a set of traffic instances corresponding to the traffic data acquired by a network node at the current moment, where traffic instance X is... B It is further processed to compute the query, key, and value, through the weight matrix W. q W k W v Perform separately Multiplication operations are used to obtain the corresponding vector representations of queries, keys, and values; then, a similarity calculation method based on Poincaré distance is used to calculate the similarity for each pair of traffic instances x. i ,x j The distance d between D (x i ,x j ), and calculate the traffic instance x based on this distance value. i ,x j The similarity for each pair of traffic instances x i ,x j The similarity is standardized, and the processed similarity is normalized to generate attention weights ω. ij Finally, the value vector is mapped to the tangent space and compared with the generated attention weights ω. ij Perform multiplication.

[0022] Furthermore, the calculation formulas for the vector representations of the query, key, and value are as follows:

[0023]

[0024] The formula for calculating the similarity is:

[0025] Similarity(x i ,x j )=-αd D (x i ,x j )

[0026] Here, α>0 is a learnable parameter used to adjust the degree of influence of distance value on similarity;

[0027] The calculation formula for the standardization process is as follows:

[0028]

[0029] Where d represents the dimension of traffic embedding;

[0030] The attention weight ω ij The calculation formula is:

[0031] ω ij =softmax(ScaledSimilarity)

[0032] The formula for calculating hyperbolic attention is:

[0033] Hyperbolic Attention(Q,K,V)=softmax(ScaledSimilarity(Q,V))·Log(V).

[0034] Furthermore, the method for constructing the network threat graph is as follows:

[0035] S2.1: Represent network devices as nodes in the diagram;

[0036] S2.2: Represent the traffic packets as edges in the graph;

[0037] S2.3: Algorithm for constructing a network threat graph;

[0038] Input: Traffic packet sequence P = (p1,…,p2);

[0039] Output: Network threat graph G = (N, E);

[0040] 1: Initialize the node set N and edge set E to empty sets;

[0041] 2: Traverse all traffic data packets:

[0042] 3: If the traffic p i The node represented by the source IP address does not exist in the graph:

[0043] 4: Add a node to the node set N, denoted as p. i [ip src ];

[0044] 5: If the traffic p i There is no edge in the graph from the source IP address node to the destination IP address node:

[0045] 6: Add an edge to edge set E, connecting node p. i [ip src ] and node pi [ip dst ];

[0046] 7: Otherwise:

[0047] 8: Traffic p i The source IP address node to the destination IP address node are updated in terms of features along the edges of the graph:

[0048] 9: Return to network threat graph G.

[0049] Where, p i [ip src ] represents the source IP address field content in the i-th traffic; p i [ip dst [] represents the destination IP address field content in the i-th traffic;

[0050] S2.4: The traffic data features are optimized by using compression and optimization techniques. At the same time, NetFlow is used to summarize the traffic data, retaining only the key information to form a data representation in NetFlow format.

[0051] S2.5: Dynamically update and detect the characteristics of nodes and edges in the network threat graph based on real-time network traffic changes, and reflect the current network status by updating the network threat graph in real time.

[0052] Furthermore, in step four, the first step is to perform neighborhood aggregation, i.e., edge aggregation, which aggregates the information passed from the node's neighboring nodes (i.e., in-degree nodes) to the current node; the formula for this process is:

[0053]

[0054] Among them, e uv Let uv represent the edges connecting node v to its neighboring node u, and N(v) represent the features of the sampled neighboring nodes of node v. N(v) Let E represent the set of edges.

[0055] Furthermore, in step four, after the first neighborhood aggregation, a second neighborhood aggregation, i.e., node aggregation, is performed to obtain the traffic features within a 2-hop range. Specifically, a hyperbolic attention mechanism is used to calculate the neighborhood weights before merging, i.e., neighborhood aggregation is performed through hyperbolic weighted aggregation. The final feature representation of the node is as follows:

[0056] h v =HyperbolicAttention(N(v))

[0057] Through two neighborhood aggregations, the features of node v can represent the traffic from neighboring nodes and the traffic characteristics between neighboring nodes.

[0058] Furthermore, in step four, after performing two neighborhood aggregations, a binary classification operation is performed: the binary classification problem of network traffic is transformed into an edge prediction task in the graph, that is, predicting whether there is an edge between two nodes. If the prediction result is "there is an edge", it indicates that the traffic is abnormal traffic; if the prediction result is "no edge", it indicates that the traffic is normal traffic. The calculation formula for the edge prediction task is:

[0059]

[0060] Where, d D (h u ,h v ) represents the distance between the embedded features of nodes u and v in the Poincaré model, where r and t are hyperparameters, and h u ,h v Let u and v represent the final feature representations of nodes u and v, respectively. The probability score of the edge is calculated using this formula, which is then used to determine whether the traffic is normal or not.

[0061] Furthermore, in step four, after performing two neighborhood aggregations, a binary classification operation is performed, and finally a multi-classification operation is performed: the features of the source node u and the target node v are first combined through a join operation to form the final feature representation z of the traffic. uv :

[0062] z uv =CONCAT(h u ,h v )

[0063] Among them, h u ,h v These represent the final feature representations of node u and node v, respectively; by applying a softmax layer to the merged edge features, the category label of the flow is output.

[0064] Furthermore, in step five, message transmission and aggregation are performed first: assuming that node v receives a set of traffic packets of size X. v ={x1,x2,…,x n}, where the flow rate x i Originating from sending node u i During the message passing phase, node v directly obtains the set of traffic packets X. v The characteristics of this feature are: during message aggregation, the aggregation function uses a hyperbolic attention mechanism to calculate the flow x using the hyperbolic distance formula. i With traffic x jThe similarity is then weighted and aggregated, and finally the features are assigned to node v; the calculation formula for this process is:

[0065] h v =Hyperbolic Attention(Q,K,V)

[0066] The aforementioned operation node v can effectively integrate features from different traffic packets within the same time period.

[0067] Furthermore, in step five, message passing and aggregation are performed first, followed by edge classification: node v obtains all in-degree traffic through message passing and aggregation, and the in-degree traffic, after being calculated by the attention mechanism, can represent the correlation between the traffic and other traffic in the same time period; for the classification of traffic i, traffic x is classified... i With traffic x i The feature representation h after aggregation with node v v {i} are merged and converted into class probabilities in the final softmax layer, and compared with the true class labels to calculate the classification evaluation performance metric.

[0068] The beneficial effects of this invention are:

[0069] 1. Improved accuracy and robustness of malicious traffic detection: By mapping network traffic data to hyperbolic space, this invention can better capture the hierarchical relationships and multi-hop dependencies between traffic, thereby improving the accuracy of malicious traffic detection. Especially when facing attack patterns in complex networks (such as IoT networks and the Internet), it can effectively identify abnormal behaviors such as DDoS attacks that are difficult to detect using traditional methods.

[0070] 2. Enhancing Network Structure Modeling Capabilities Using Hyperbolic Space: Traditional network traffic analysis methods often neglect the geometric structure of traffic data and the hierarchical relationships between nodes. This invention, by embedding traffic into a Poincaré sphere (hyperbolic space), fully utilizes the geometric characteristics of this space, enhancing the model's ability to model multi-level, multi-hop dependencies and improving its perception of network topology.

[0071] 3. Flexible Traffic Feature Aggregation: By combining hyperbolic attention mechanism, this invention can dynamically adjust the weights of features of each node when aggregating neighborhood features, thereby more accurately representing the similarity and relationship between traffic flows. This improves the effectiveness of information transmission and avoids recognition errors caused by feature distortion or information loss in traditional methods.

[0072] 4. Efficient Edge Classification Method: This invention transforms the traffic classification task into an edge classification task in a graph, effectively distinguishing between normal and abnormal traffic through edge prediction. This method comprehensively considers the characteristics of both sending and receiving nodes, further improving the accuracy of malicious traffic identification, and avoiding the limitations of single-node classification in traditional methods.

[0073] 5. Adaptability to Different Network Environments: Taking into account the differences between IoT networks and the traditional Internet, this invention proposes specialized optimization schemes for both IoT networks and the Internet. For example, low-power devices and limited features in IoT networks can be effectively handled through simplified traffic modeling methods, while for environments involving complex traffic and a large number of unknown nodes in the Internet, this invention uses the Raw Packet Acquisition (PCAP) method for traffic feature extraction, thereby improving the system's universality and adaptability.

[0074] In summary, by combining hyperbolic geometry models with graph neural networks, this invention can effectively improve the accuracy of network traffic analysis and malicious traffic detection, especially in large-scale and complex network environments, where it has significant advantages. Attached Figure Description

[0075] Figure 1 This is a schematic diagram of hyperbolic convergence. Detailed Implementation

[0076] The present invention will be further described in detail below with reference to the accompanying drawings.

[0077] This invention provides a malicious traffic detection method based on hyperbolic space modeling and graph neural networks, which specifically includes the following steps:

[0078] Step S1: Establish a hyperbolic attention mechanism;

[0079] Scaled Dot-ProductAttention is a core component of the Transformer model, widely used for processing sequential data, particularly in tasks such as natural language processing and computer vision. Its main purpose is to compute relationships between queries, keys, and values, dynamically assigning appropriate weights to each input across multiple inputs. Scaled Dot-ProductAttention extracts relevant information between elements in a sequence by calculating the similarity between queries and keys and using this similarity to weight values.

[0080] In Scaled Dot-ProductAttention, the dot product between the query and the key is first calculated to measure their similarity. The query and key are typically vector representations obtained through training, reflecting the semantic relationships between different parts of the input data. Next, to avoid excessively large dot product values ​​that could lead to vanishing gradients or numerical instability, the result is scaled by dividing it by the square root of the key vector's dimension. This effectively prevents numerical instability caused by excessively large values, ensuring a more stable model training process.

[0081] Then, the scaled result is transformed into a set of weight values ​​by applying the softmax function. The softmax function maps these weights to a probability distribution by normalizing the dot product results; these weights reflect the relevance of each value to the query. Finally, these weights are multiplied by their corresponding values ​​and summed to obtain the final output. This output is a weighted feature representation containing information calculated based on the similarity between the query and the key. The mathematical expression for this process is as follows:

[0082]

[0083] Where softmax represents the softmax function, Q, K, and V are the vector representations of the query, key, and value, respectively, T represents the transpose, and d k For the dimensions of Q and K.

[0084] However, network traffic data exhibits significant hierarchical characteristics, such as the tree structure of IP addresses, layered dependencies in protocol stacks, and topological features of traffic paths. Traditional attention mechanisms based on Euclidean space struggle to effectively model the inherent geometric relationships within this type of data. Therefore, this invention also proposes an attention computation paradigm based on the Poincaré model as the main computational module. Through hyperbolic geometric reconstruction of similarity calculation and feature aggregation processes, it achieves dynamic modeling of hierarchical traffic dependencies. The specific implementation process is as follows:

[0085] S1.1: Input definition and QKV construction;

[0086] In a network intrusion detection system, the traffic data acquired by a network node at the current moment is typically composed of a set of traffic instances X. R ={x1,x2,…,x n} is represented as follows, where each traffic instance x i ∈R nA hyperbolic vector is a multidimensional vector containing several important features, such as packet size, protocol type, source IP address, destination IP address, and transmission delay. These features are a simplified representation of network traffic, used to capture basic information about network communication. However, these feature representations in Euclidean space often fail to fully capture the underlying hierarchical structure and topological relationships within network traffic. To achieve hyperbolic space modeling, the Euclidean features need to be mapped to a Poincaré sphere Bi. n , that is, X B =exp(X R In hyperbolic space, traffic instance X B The data is further processed to compute the query, key, and value, which are key components in building the hyperbolic attention mechanism. To obtain vector representations of the query, key, and value, the traffic features first need to be transformed using hyperbolic geometric operations. In traditional neural networks, the computation of the query, key, and value is typically achieved through linear transformations and weighted summations. However, in hyperbolic space, this is achieved through operations with the weight matrix W... q W k W v Perform separately Multiplication operations are used to obtain vector representations of the corresponding queries, keys, and values. These weight matrices W q W k W v These are parameters obtained through training, used to analyze traffic instance X. B A transformation is performed to achieve effective feature extraction and representation learning. The specific calculation formulas for the vector representations of queries, keys, and values ​​are as follows:

[0087]

[0088] S1.2: Hyperbolic similarity calculation;

[0089] In attention mechanisms within Euclidean space, the similarity between queries and keys is typically measured using a dot product. Specifically, the similarity is assessed by calculating the dot product between the query vector and the key vector, thus determining the weight of each value when calculating the weighted sum. However, the Poincaré sphere, as a representation of hyperbolic geometry, lacks a natural definition of the dot product similar to that in Euclidean space, making it impractical to directly employ the traditional dot product method to measure similarity.

[0090] To address this issue, this invention proposes a similarity calculation method based on Poincaré distance. The distance formula in Poincaré spherical space differs from the standard Euclidean distance in Euclidean space; it reflects the relative positions of data points in hyperbolic geometry. Therefore, the first step is to use the Poincaré distance formula to calculate the similarity of each pair of flow instances x. i ,x j The distance d between D (x i ,x j Then, based on this distance value, their similarity is calculated. The smaller the distance, the more similar the two points are; the larger the distance, the lower their similarity. The specific similarity calculation formula is as follows:

[0091] Similarity(x i ,x j )=-αd D (x i ,x j )

[0092] Here, α>0 is a learnable parameter used to adjust the degree of influence of distance values ​​on similarity. By adjusting the parameter α, the model can flexibly control the role of distance changes in calculating similarity, ensuring that the model can be optimized according to the characteristics of the data in different application scenarios.

[0093] To further improve the stability and effectiveness of similarity calculation, this invention also standardizes the similarity. Specifically, the similarity of each pair of traffic instances is standardized using the following standardized similarity formula:

[0094]

[0095] Here, d represents the dimension of the traffic embedding. Standardized similarity avoids the excessive impact of distance variations on similarity calculation in high-dimensional space, making the calculation process more stable. Based on this, this invention can further use the softmax function to normalize the similarity, generating the final attention weight ω. ij The specific calculation formula is as follows:

[0096] ω ij =softmax(ScaledSimilarity)

[0097] By employing this similarity calculation method based on Poincaré distance, this invention can more accurately reflect data relationships in hyperbolic geometry, demonstrating significant advantages, especially when dealing with data exhibiting substantial hierarchical structures or complex dependencies. In network intrusion detection tasks, this method can effectively capture complex similarities between traffic flows, thereby improving the model's detection performance and robustness.

[0098] S1.3: Hyperbolic weighted aggregation;

[0099] In hyperbolic space, proceed directly When using addition and multiplication to implement weighted aggregation, numerical stability issues may arise, especially when data points approach the boundary of the Poincaré sphere. The boundary of the Poincaré sphere corresponds to points at infinity, and as points approach the boundary, the calculated values ​​can become extremely unstable. This is because in Poincaré space, the distance between points increases exponentially with the curvature of the space, particularly near the boundary, where the distances become very large, leading to inaccurate numerical calculations. Therefore, to avoid this instability, further processing in tangent space is usually required.

[0100] Specifically, when weighting and aggregating attention, the value vector V can be mapped to the tangent space and then multiplied with the calculated attention weights. Based on this, the final hyperbolic attention calculation formula can be expressed as:

[0101] Hyperbolic Attention(Q,K,V)=softmax(ScaledSimilarity(Q,V))·Log(V)

[0102] This invention is the first to combine Poincaré geometry with traditional attention mechanisms, leveraging the hierarchical properties of hyperbolic space to enhance the model's ability to model network traffic structures. This property allows the model to naturally focus more on traffic instances within the same hierarchical structure—i.e., traffic points with high similarity—when calculating attention weights. This focusing mechanism helps the model better identify and distinguish between normal and abnormal traffic, especially in network data with complex hierarchical relationships, effectively improving the model's classification and detection performance.

[0103] Step S2: Network threat graph construction;

[0104] Traditional network intrusion detection systems (IDS) typically rely on static rules or behavior-based analysis to detect potential threats in network traffic. While these methods are effective at detecting some known attack behaviors, they often fall short when facing increasingly complex and dynamic network attacks. With the continuous evolution of network attack methods, IDS also face challenges such as complex traffic patterns, diverse attack methods, and massive traffic data volumes. To better adapt to the needs of modern network security, graph-based representation methods are gradually becoming an effective solution. By mapping network devices and traffic data into a graph structure, IDS can more intuitively capture the relationships between nodes and traffic patterns, thereby improving its ability to perceive and detect attack behaviors. The construction of a network threat graph helps the system analyze traffic from a global perspective, identify potential attack activities, and provide strong support for real-time intrusion detection.

[0105] S2.1: Represent network devices as nodes in the diagram;

[0106] The first step in constructing a network threat graph is to map various network devices (such as hosts, routers, and switches) as nodes in the graph. Each network device is transformed into a node in the graph based on its role in the network; these devices include, but are not limited to, terminal devices, network routers, switches, and firewalls. In a network threat graph, the primary function of nodes is to send and receive network traffic; therefore, the connections between nodes are the key focus.

[0107] While each node may have different hardware performance, configuration, and security policies, this invention focuses primarily on the topology between nodes and traffic transmission patterns in network threat graphs, rather than the specific hardware or configuration details of the nodes. In this case, node characteristics can be simplified to identifiers or basic attributes, or even left blank. In the graph, the interconnections between nodes represent the direction and path of data flow in the network, information crucial for identifying potential intrusion behaviors. For example, in a DDoS (Distributed Denial of Service) attack network threat graph, the attacking node is typically the source of traffic, while the target node is the attacked server. By analyzing the interactions between these nodes and packet transmission paths, network threat graphs can effectively reveal potential patterns of attack behavior.

[0108] S2.2: Represent the traffic packets as edges in the graph;

[0109] In a network, data packets play a crucial role in information exchange, connecting different nodes. In constructing a network threat graph, each data packet can be viewed as an edge, establishing connections with other nodes through the sending and receiving of packets. The direction of data packet transmission determines the directionality of the edges when building the graph structure. That is, when node A sends a data packet to node B, a directed edge from A to B is formed in the graph. In this way, the network threat graph can visually represent the path and direction of data flow, which helps network intrusion detection systems identify network traffic behavior patterns.

[0110] Edge characteristics are typically represented using basic attributes of traffic packets, such as packet size, transport protocol type, and latency. These attributes provide crucial traffic information for constructing network threat graphs, thus helping network intrusion detection systems (IDS) determine the presence of abnormal behavior. In many attack scenarios, certain abnormal characteristics of traffic packets (such as drastic fluctuations in packet size or unusually frequent connection requests) are often precursors to attacks. Therefore, edge characteristics are of paramount importance for effective network intrusion detection. For example, during a DDoS attack, attackers often exhaust the target server's resources by sending a large number of small data packets, and the characteristics of these packets can be used by IDS to identify abnormal traffic patterns.

[0111] S2.3: Algorithm for constructing a network threat graph;

[0112] The specific implementation process of the network threat graph construction algorithm in this invention is as follows:

[0113] Input: Traffic packet sequence P = (p1,…,p2);

[0114] Output: Network threat graph G = (N, E);

[0115] 1: Initialize the node set N and edge set E to empty sets;

[0116] 2: for p i ∈P do(traverse all traffic packets):

[0117] 3: If node p i [ip src ] does not exist (if the flow p) i (The node represented by the source IP address does not exist in the graph):

[0118] 4: Add a node to the node set N, denoted as p. i [ip src ];

[0119] 5: If p i [ipsrc ]to p i [ip dst ] does not exist (if the flow p) i (There are no edges between the source IP address node and the destination IP address node in the graph):

[0120] 6: Add an edge to edge set E, connecting node p. i [ip src ] and node p i [ip dst ];

[0121] 7: Otherwise:

[0122] 8: Update side p i [ip src top i [ip dst ](flow p i (Feature updates are performed on the edges of the graph from the source IP address node to the destination IP address node):

[0123] 9: Return to network threat graph G.

[0124] Where, p i [ip src ] represents the source IP address field content in the i-th traffic; p i [ip dst ] represents the destination IP address field content in the i-th traffic.

[0125] S2.4: Feature Optimization and NetFlow Representation;

[0126] In practical applications, especially in bandwidth- and power-constrained environments such as the Internet of Things (IoT), the volume and feature dimensions of traffic data are often enormous. Directly monitoring and processing each data packet not only increases the computational burden on the system but can also lead to network overload, affecting the real-time performance and efficiency of detection. To address this issue, traffic data feature compression and optimization techniques are commonly employed. NetFlow, as a common network traffic monitoring protocol, has been widely used for traffic data aggregation and compression. By aggregating traffic data and retaining only key information such as source IP, destination IP, traffic size, protocol type, and session duration, NetFlow significantly reduces the data volume while also lowering the burden on storage and computation. In this way, network intrusion detection systems can process large amounts of network traffic without losing critical information. Especially in IoT scenarios, where devices typically have low power consumption and low bandwidth, data transmission using the NetFlow format can effectively reduce bandwidth consumption and improve the efficiency of network intrusion detection. For example, devices in IoT networks often have low bandwidth and power limitations, so traditional methods based on Raw Packet Acquisition (PCAP) may encounter performance bottlenecks when dealing with large volumes of data. Using traffic signatures in the NetFlow format can compress traffic data, reducing network bandwidth consumption and improving the efficiency of network intrusion detection systems (NICs) under bandwidth-constrained or computationally limited conditions. By combining this signature optimization with the NetFlow format, network threat graphs can express traffic information more efficiently, helping NICs maintain high performance and accuracy even with massive traffic volumes. Furthermore, using this optimized data, NICs can analyze network traffic characteristics from a more holistic perspective, enhancing their ability to identify complex attacks.

[0127] S2.5: Dynamic updates and real-time detection of network threat maps;

[0128] The construction of a network threat map relies not only on static device connection information but also on dynamic updates based on real-time network traffic changes. As network status and traffic data constantly change, network intrusion detection systems need to update the network threat map in real time to reflect the current network condition. By combining network topology and traffic data characteristics, the network threat map can assess the risks of nodes in the network from a more global perspective and identify potential security threats in real time.

[0129] When constructing a network threat graph, network traffic data can be collected periodically or in real-time, and the characteristics of nodes and edges in the graph can be updated. This dynamic updating method helps network intrusion detection systems to identify new attack patterns in a timely manner, especially providing a more sensitive detection mechanism for complex attacks (such as Advanced Persistent Threats (APTs) or stealthy attacks). Furthermore, as network traffic increases and the number of devices changes, updating the network threat graph ensures that the network intrusion detection system keeps pace with changes in the network environment, thereby providing real-time and effective security protection.

[0130] Step S3: Network intrusion detection model based on hyperbolic edge graph;

[0131] S3.1: System Model;

[0132] This section aims to study modeling network traffic data as a network threat graph and utilize graph embedding techniques to improve the detection effectiveness of malicious traffic. In the field of network security, the topology of cyberspace can be efficiently represented using graph data. Hosts, routers, and other devices in the network can be considered as nodes in the graph, while the information interactions between these devices correspond to the edges. By aggregating node features, effective representations that aid in classification tasks can be extracted, further improving the performance of network intrusion detection systems.

[0133] Specifically, traditional network intrusion detection systems primarily rely on static rules or behavior-based analysis. Graph-based methods, however, can more intuitively capture the complex relationships and traffic patterns between nodes in a network. Especially when facing complex attacks, graph structures effectively present the hierarchical characteristics and topological dependencies of traffic data. Therefore, considering the diversity and complexity of network traffic data, transforming the malicious traffic detection problem into a graph-based edge classification task can fully leverage the structural characteristics of graph data, thereby effectively improving the performance of network intrusion detection systems.

[0134] In this invention, network communication is first transformed into a graph structure, and statistical features of network traffic data and topological features between devices are extracted. Furthermore, this invention designs a novel edge embedding method that maps graph embeddings to hyperbolic space to fully utilize the structural information and features of the graph, thereby generating an edge embedding representation suitable for malicious traffic detection. In other words, the malicious traffic detection task is reformulated as an edge classification problem, which allows for more effective identification of malicious traffic in the network.

[0135] In the model construction process, the original network traffic data is first preprocessed to transform it into a network threat graph, and then divided into training and testing sets to provide a foundation for subsequent model training. The main idea of ​​the GraphSAGE (Graph Sample and Aggregation) algorithm is to construct a global feature representation by aggregating the features of a node's neighbors. Through multiple neighbor message passing and aggregation, the node's features can effectively represent the features of its multi-hop neighbors and their relationship with itself, thus performing excellently in graph node classification tasks. However, malicious traffic detection tasks mainly focus on traffic classification, therefore, it is necessary to transform the traditional node classification task into an edge classification task.

[0136] To address this, this invention proposes two improved GraphSAGE algorithms specifically optimized for graph edge classification tasks, and introduces a hyperbolic attention mechanism to weight features during neighborhood aggregation. The improved algorithms are named Hyper-GraphSAGE, and targeted optimization strategies are proposed for different network environments (such as IoT networks and the traditional Internet).

[0137] Specifically, Hyper-GraphSAGE, through graph embedding in hyperbolic space, not only fully captures the geometric characteristics of network traffic but also effectively models the hierarchical dependencies between nodes in the network. This method leverages the large distance variations in hyperbolic space to enhance the ability to distinguish low-frequency anomalous traffic, while simultaneously improving the ability to model complex patterns of network traffic through hyperbolic geometry. Compared to traditional Euclidean space methods, hyperbolic space provides a geometric structure that better reflects real-world network topology, helping to improve the model's performance in malicious traffic detection tasks.

[0138] During training, Hyper-GraphSAGE learns edge embedding representations of network traffic data through graph embedding, thus providing a foundation for subsequent classification of normal and malicious traffic. As a feature extraction model, Hyper-GraphSAGE can effectively aggregate and transform raw traffic features to construct more discriminative feature representations, which is crucial for the accurate identification of malicious traffic.

[0139] Through the above methods, the present invention aims to improve the network intrusion detection system's ability to respond to complex and dynamic network attacks, especially in providing flexible solutions when facing different attack scenarios of IoT networks and traditional Internet.

[0140] In summary, this invention models network traffic data as a graph structure through a graph-based edge classification task, and proposes the Hyper-GraphSAGE model by introducing an improved method using hyperbolic space and attention mechanisms. This model first maps all traffic to a hyperbolic space, and all operations are performed within this hyperbolic space. Through hyperbolic space embedding and weighted processing using neighborhood aggregation, it effectively improves the accuracy of malicious traffic detection and provides strong support for further network security defense.

[0141] S3.2: Hyper-GraphSAGE-IoT Algorithm for IoT Networks;

[0142] Internet of Things (IoT) networks enable environments and devices to intelligently sense, analyze, and respond by interconnecting various devices and sensors. Key characteristics of IoT networks include a large number of devices, device heterogeneity, low power consumption, high real-time performance, large-scale data processing requirements, and a strong reliance on security. With technological advancements, IoT is gradually penetrating more fields and playing an increasingly important role in scenarios such as smart cities, smart homes, and intelligent transportation. However, the complexity and openness of IoT networks also bring higher requirements for network architecture, data processing, and security.

[0143] In IoT networks, all nodes typically belong to a controllable system, such as drone swarms, smart home devices, and vehicle networks. Especially within internal local area networks (LANs), communication between nodes is limited to the LAN itself, and network attacks often occur within this network. Therefore, IoT scenarios are well-suited for building and maintaining network threat graphs. By leveraging multi-hop information transmission and feature aggregation, network attacks can be captured more comprehensively, particularly for attacks like Distributed Denial-of-Service (DDoS), where information from a single node is often difficult to identify, while collaborative information across multiple hops significantly improves detection capabilities.

[0144] This invention proposes an improved algorithm for IoT networks—Hyper-GraphSAGE-IoT—based on the E-GraphSAGE algorithm. This algorithm executes the GraphSAGE algorithm on both the source and target nodes, concatenates the features of the two nodes to form an embedded representation of the network traffic, and then performs classification. To capture information within a two-hop range, this invention designs two neighborhood aggregation operations. Through these two aggregations, nodes can obtain richer traffic features, making it more suitable for attack detection such as DDoS attacks that require multi-hop information.

[0145] S3.2.1: First Neighborhood Aggregation – Edge Aggregation;

[0146] Since this invention focuses on in-degree traffic information, the node's own characteristics do not directly participate in the first neighborhood aggregation. Specifically, the first neighborhood aggregation operation aims to aggregate the information passed from the node's neighboring nodes (i.e., in-degree nodes) to the current node. This process can be represented by the following formula:

[0147]

[0148] Among them, e uv Let uv represent the edges connecting node v to its neighboring node u, and N(v) represent the features of the sampled neighboring nodes of node v. N(v) Let E represent the set of edges. Through the first neighborhood aggregation, the features of a node can represent the features of all in-degree traffic around it, for subsequent secondary transmission.

[0149] S3.2.2: Second Neighborhood Aggregation – Node Aggregation;

[0150] After the first neighborhood aggregation, each node represents the received traffic information. A second aggregation of neighborhood information between nodes is then performed to obtain the traffic characteristics within a two-hop range. However, to better distinguish the relationships between neighboring nodes during neighborhood node aggregation, this invention employs a hyperbolic attention mechanism. The neighborhood weights are calculated before merging, i.e., neighborhood aggregation is performed through hyperbolic weighted aggregation. The final feature representation of a node can be expressed by the following formula:

[0151] h v =HyperbolicAttention(N(v))

[0152] Using this method, the features of node v can represent the traffic from neighboring nodes and the traffic features between neighboring nodes, and globally represent the traffic feature information within a 2-hop range. This is very suitable for collecting the features of attacks that require multiple hops, such as DDoS attacks.

[0153] S3.2.3: Binary classification method;

[0154] In network intrusion detection systems, classifying traffic into normal and abnormal traffic is an efficient monitoring method. A significant advantage of using binary classification methods is that it simplifies the traffic classification task, especially when facing some simple attack patterns (such as traffic surges caused by DDoS attacks). By focusing on learning the characteristics of abnormal traffic, binary classification methods can effectively improve the model's recognition accuracy and robustness. Compared with multi-class classification methods, binary classification is more focused and singular, allowing the training process to concentrate on the differences between "normal" and "abnormal," thereby reducing the risk of misclassification.

[0155] For the binary classification problem of network traffic, this invention transforms it into an edge prediction task in a graph, namely, predicting whether an edge exists between two nodes. If the prediction result is "edge exists," it indicates that the traffic is abnormal; if the prediction result is "no edge," it indicates that the traffic is normal. In this way, this invention can fully utilize the mutual characteristics between nodes, especially the interaction characteristics between the source node and the target node in the graph. In the Hyper-GraphSAGE model, this invention continues to use the distance formula from the Poincaré model for edge prediction.

[0156] For the edge prediction task, this invention employs the Fermi-Dirac decoder, a generalized form of the sigmoid function, which can effectively calculate the probability score of edges. The specific calculation formula is as follows:

[0157]

[0158] Where, d D (h u ,h v ) represents the distance between the embedded features of nodes u and v in the Poincaré model, where r and t are hyperparameters, and h u ,h v Let u and v represent the final feature representations of nodes u and v, respectively. This formula allows us to calculate the probability score of each edge, thereby determining whether the traffic flow is normal or not.

[0159] S3.2.4: Multi-classification method;

[0160] In more complex network intrusion detection scenarios, in addition to classifying traffic as normal or abnormal, it is also necessary to further identify the specific attack type of malicious traffic. In this case, this invention employs a multi-classification method to classify traffic. Through multiple message passing and feature aggregation, this invention can extract the final representation of the traffic from the features of the source and target nodes. Specifically, after two rounds of aggregation, the features of the source node u and the target node v can be used to form the final feature representation z of the traffic through a join operation (CONCAT). uv The specific calculation formula is as follows:

[0161] z uv =CONCAT(h u ,h v )

[0162] Finally, by applying a softmax layer to the merged edge features, the category label of the traffic can be output. Through multi-classification, this invention can more accurately identify various types of malicious attack traffic, such as DDoS attacks, network scanning, and malware propagation, providing more comprehensive support for network intrusion detection.

[0163] S3.3: Hyper-GraphSAGE-internet algorithm for the Internet;

[0164] In IoT networks, since all devices and sensors are connected and managed by a central server, communication between nodes can be centralized. Therefore, this invention can aggregate network information to a central server and perform unified graph construction through the central server. Message passing and feature aggregation between nodes can also be completed on the central server, thereby easily obtaining feature information of two-hop neighborhoods. This method is very effective in IoT networks because communication between all nodes is open and transparent.

[0165] However, the situation is quite different in the internet environment, especially in common application servers or personal servers. The internet contains a variety of unknown nodes, and servers typically only receive traffic packets destined for themselves, without knowing which traffic data the sender received. Therefore, it's impossible to perform multiple, multi-node message passing and feature aggregation as in IoT networks, nor can edge features be represented by concatenating the features of sending and receiving nodes. In this context, this invention can only analyze traffic packets currently received by the server.

[0166] Furthermore, devices in IoT networks typically have low communication efficiency, and traffic data formats (such as NetFlow) are relatively simplified, relying primarily on the physical topology characteristics between network nodes to assist in identifying malicious traffic. However, in the Internet environment, servers can obtain much richer traffic data, allowing this invention to use more detailed traffic data to represent traffic characteristics. Therefore, the Packet Capture Approach (PCAP) format is commonly used on the Internet to describe traffic characteristics, providing more detailed features for malicious traffic detection.

[0167] S3.3.1: Message passing and aggregation;

[0168] In the internet environment, because servers cannot obtain specific information about the sending node, traffic classification models need to focus on the characteristics of the received traffic packets themselves. When a malicious node launches an attack on a server, it may involve multiple traffic streams (such as DoS or DDoS attacks). Therefore, when classifying a single traffic stream, it is necessary to consider other traffic streams occurring within the same time period. By jointly analyzing traffic data from the same time frame, the type of attack can be determined more accurately.

[0169] This method is very similar to the message passing and aggregation processes in graph neural networks. The hyperbolic aggregation process is as follows: Figure 1As shown. In this process, the present invention still draws on the idea of ​​GraphSAGE, except that in the Internet scenario, message passing and feature aggregation are only performed on the server node. Since the server node cannot obtain the sender's traffic information, it can only focus on the traffic data it receives. Therefore, the present invention aggregates the traffic data received by the server node and uses a hyperbolic attention mechanism to calculate the similarity between different traffic packets.

[0170] Suppose that node v receives a set of traffic packets called X. v ={x1,x2,…,x n}, where the flow rate x i Originating from sending node u i During the message passing phase, node v directly obtains the set of traffic packets X. v To better integrate traffic with concurrent traffic, the aggregation function uses a hyperbolic attention mechanism during message aggregation, calculating the traffic x using the hyperbolic distance formula. i With traffic x j The similarity is then used for weighted aggregation, and finally the features are assigned to node v. The specific calculation formula for this process is as follows:

[0171] h v =Hyperbolic Attention(Q,K,V)

[0172] In this way, node v can effectively integrate features from different traffic packets within the same time period, thereby improving the accuracy of traffic classification, especially when facing complex attacks (such as DDoS), and better capturing the multi-hop dependencies of attack patterns. This message passing and aggregation method based on hyperbolic attention mechanism can better address the challenges of complex traffic features and incomplete node information in the Internet, and improve the performance of malicious traffic detection.

[0173] S3.3.2: Edge classification;

[0174] Node v obtains all in-degree traffic through message passing and aggregation, and the in-degree traffic, after being processed by an attention mechanism, represents the correlation between the traffic and other traffic in the same time period. For the classification of traffic i, during the classification process, traffic x... i and h v {i}(flow x) i The features (features aggregated with node v) are merged and converted into class probabilities in the final softmax layer. Finally, they are compared with the true class labels to calculate the classification evaluation performance metric.

[0175] During the message passing and aggregation phases, node v collects feature representations of all in-degree traffic. Through an attention mechanism, these traffic features are weighted to represent the correlation between each traffic and other traffic within the same time period. In this way, node v not only obtains features from individual traffic sources but also captures the relationships between traffic, thus providing a more comprehensive feature representation for subsequent classification tasks.

[0176] Specifically, regarding the classification of traffic i, this invention first classifies traffic x... i The feature representation h after aggregation with node v v {i} are merged. The merged feature includes the flow x. i The system inputs information from the network and multi-hop neighborhood information obtained by node v through message passing and aggregation. The merged features are then fed into the final softmax layer of the classification network, which outputs the probability distribution for each possible class. Finally, these probability values ​​are compared with the true class labels to calculate classification performance metrics such as accuracy, precision, and recall.

[0177] In this way, the model can make classification decisions based on the characteristics of the traffic itself and the aggregated information from surrounding nodes, thereby improving the accuracy and robustness of classification when faced with complex network traffic data.

[0178] The key points of this invention are as follows:

[0179] 1. Hyperbolic Space and Hierarchical Structure Modeling: Many network intrusion behaviors (such as DDoS attacks and worm attacks) exhibit hierarchical characteristics in network topology. Traditional Euclidean space struggles to effectively capture these complex hierarchical relationships, while the negative curvature and high dimensionality of hyperbolic space can better model such complex network structures. Compared to Euclidean space, hyperbolic space represents hierarchical data more naturally and can effectively capture hierarchical structures in networks with fewer parameters. Therefore, intrusion detection methods based on hyperbolic graph neural networks can provide better computational and storage efficiency when processing large-scale network traffic data, and are particularly suitable for high-dimensional and complex topology scenarios.

[0180] 2. Traffic Modeling with Topological Structure: Addressing the limitations of ordinary neural networks in handling single-traffic threat detection, a novel method for modeling traffic between network nodes is proposed, transforming network traffic into a graph with a topological structure. Traffic characteristics differ between IoT networks and traditional internet networks, requiring separate considerations in traffic modeling. For IoT networks, the low power consumption of devices and the large number of network nodes make maintaining a threat graph difficult; therefore, the NetFlow format is used to represent edge features, effectively expressing traffic characteristics. For internet networks, only a single server and the nodes sending traffic to it can be maintained as the network threat graph; edge features only include traffic sent to the server, allowing for more complex traffic feature representations.

[0181] 3. A Poincaré-based Attention Mechanism: Inspired by the attention mechanism in Transformers, a Hyperbolic Attention mechanism based on the Poincaré model was designed. When calculating sequence similarity, the distance formula in Poincaré space is used instead of the traditional dot product operation, thus better capturing the correlation between sequences and leveraging the hierarchical advantages of hyperbolic space. This mechanism improves the model's performance on long-tailed data, especially when dealing with complex attack patterns, effectively enhancing detection accuracy and robustness.

[0182] 4. Algorithm Design for Different Network Scenarios: Corresponding graph neural network algorithms were designed based on different network environments. In IoT networks, a feature extraction method based on a 2-hop graph neural network was proposed. Feature extraction is performed through two message passing and aggregation operations, and a hyperbolic attention mechanism is introduced in the second aggregation to link neighboring nodes. For Internet networks, since it is impossible to obtain traffic information from non-server nodes, the model is designed with one message passing and aggregation, while simultaneously using a hyperbolic attention mechanism to aggregate and link in-degree traffic, thereby enhancing the ability to capture attack characteristics.

[0183] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for malicious traffic detection based on hyperbolic space modeling and graph neural networks, characterized in that, The method comprises the following steps: Step 1: Establishing hyperbolic space and attention mechanism; Step 2: Converting the malicious traffic detection problem into a graph-based edge classification task, and modeling network traffic data into a network threat graph based on the graph-based edge classification task; Step 3: Introducing hyperbolic space and attention mechanism based on the network threat graph, and constructing a Hyper-GraphSAGE model; Step 4: Constructing a Hyper-GraphSAGE-IoT algorithm for an IoT network; using the algorithm to execute a GraphSAGE algorithm on a source node and a target node respectively, splicing the features of the two nodes to form an embedding representation of the traffic data, and finally performing classification processing; First, the first neighborhood aggregation, i.e., edge aggregation, is performed to aggregate the information passed by the in-degree node of the neighbor node of the node to the current node; the formula of the process is: wherein e uv denotes an edge uv connecting node v and neighbor node u, N(v) denotes sampling neighbor nodes of node v, and the aggregated features of the sampled neighbor nodes are denoted by h N(v) denotes, and E denotes an edge set; After the first neighborhood aggregation, the second neighborhood aggregation, i.e., node aggregation, is performed to obtain the traffic features within a 2-hop range; specifically, the neighborhood weights are calculated through hyperbolic space and attention mechanism and then combined, i.e., neighborhood aggregation is performed through hyperbolic weighted aggregation, and the final feature representation of the node is: h v = HyperbolicAttention(N(v)) Through the two neighborhood aggregations, the features of the node v can represent the traffic from the neighbor nodes and the traffic features between the neighbor nodes of the neighbor nodes; After the two neighborhood aggregations, a binary classification operation is performed: the binary classification problem of network traffic is converted into an edge prediction task in a graph, i.e., predicting whether there is an edge between two nodes; if the prediction result is "edge exists", it indicates that the traffic is abnormal traffic; if the prediction result is "no edge", it indicates that the traffic is normal traffic; the calculation formula of the edge prediction task is: where d D (h u ,h v ) represents the distance between the embedding features of node u and node v in the Poincare model, r and t are hyperparameters, h u ,h v represent the final feature representations of node u and node v, respectively; the probability score of the edge is calculated through the formula, and then the normality of the traffic is judged. First, the two neighbor aggregation operations are performed, then the binary classification operation is performed, and finally the multi-classification operation is performed: the features of the source node u and the target node v are connected to form the final feature representation z of the traffic uv : z uv =CONCAT(h u ,h v ) where h u ,h v respectively represent the final feature representation of node u and node v; by applying a softmax layer on the merged edge features, the class label of the traffic is output. Step 5: Constructing a Hyper-GraphSAGE-internet algorithm for an Internet network; using the algorithm to aggregate the traffic data received by the server node, and using hyperbolic space and attention mechanism to calculate the similarity between different traffic packets; First, we perform message transmission and aggregation: Assume that node v receives a set of traffic packets called X. v ={x1,x2,…,x n }, where the flow rate x i Originating from sending node u i During the message passing phase, node v directly obtains the set of traffic packets X. v Features; during message aggregation, the aggregation function uses hyperbolic space and attention mechanisms to calculate the flow x using the hyperbolic distance formula. i With traffic x j The similarity is then weighted and aggregated, and finally the features are assigned to node v; the calculation formula for this process is: h v = Hyperbolic Attention(Q, K, V) Through the above operations, the node v can effectively integrate the features of different traffic packets in the same time period; First, message passing and aggregation, then edge classification: node v obtains all the in-degree traffic through message passing and aggregation, and the in-degree traffic can represent the correlation between the traffic and other traffic in the same time period after attention mechanism calculation; for the classification of traffic i, traffic x i and the feature representation h i of node v after aggregation v {i} are merged, converted into class probability in the final softmax layer, and compared with the real class label to calculate the classification evaluation performance indicators.

2. The malicious traffic detection method based on hyperbolic space modeling and graph neural networks according to claim 1, characterized in that, In step one, hyperbolic space modeling is first performed, mapping Euclidean features to the Poincaré sphere B. n , that is, X B =exp(X R ), X R ={x1,x2,…,x n } represents a set of traffic instances corresponding to the traffic data acquired by a network node at the current moment, where traffic instance X is... B It is further processed to compute the query, key, and value, through the weight matrix W. q W k W v Perform separately Multiplication operations are used to obtain the corresponding vector representations of queries, keys, and values; then, a similarity calculation method based on Poincaré distance is used to calculate the similarity for each pair of traffic instances x. i ,x j The distance d between D (x i ,x j ), and calculate the traffic instance x based on this distance value. i ,x j The similarity for each pair of traffic instances x i ,x j The similarity is standardized, and the processed similarity is normalized to generate attention weights ω. ij Finally, the value vector is mapped to the tangent space and compared with the generated attention weights ω. ij Perform multiplication.

3. The method of claim 2, wherein, The calculation formulas of the vector representations of the query, the key and the value are respectively: The calculation formula of the similarity is: Similarity(x i ,x j ) = -a d D (x i ,x j ) Wherein, α>0 is a learnable parameter for adjusting the influence degree of the distance value on the similarity; The calculation formula of the standardization processing is: Wherein, d represents the dimension of the traffic embedding; The attention weight ω ij The calculation formula is: ω ij = softmax(ScaledSimilarity) The calculation formula of the hyperbolic attention is: Hyperbolic Attention(Q, K, V) = softmax(ScaledSimilarity(Q, V))·Log(V).

4. The malicious traffic detection method based on hyperbolic space modeling and graph neural networks according to claim 1, characterized in that, The construction method of the network threat graph is: S2.1: Representing network devices as nodes in a graph; S2.2: Representing traffic packets as edges in a graph; S2.3: Network threat graph construction algorithm; Input: traffic packet sequence P=(p1,…,p2); Output: network threat graph G=(N,E); 1: Initialize the node set N and the edge set E as empty sets; 2: Traverse all traffic packets: 3: If the flow p i the node represented by the source ip address does not exist in the graph: 4: Add a node to the set of nodes N, the node is denoted as p i [ip src ] 5: If flow p i Source IP address node to destination IP address node has no edge in the graph: 6: add an edge to the edge set E connecting node p i [ip src ] and node p i [ip dst ] 7: Otherwise: 8: flow p i The source IP address node to destination IP address node in the edge of the figure is updated: 9: Return the network threat graph G; where p i [i p src ] denotes the source IP address field content in the i-th flow; p i [i p dst ] denotes the destination IP address field content in the i-th flow; S2.4: The compression and optimization technology of flow data features is used to optimize the features of flow data, and NetFlow is used to aggregate flow data, only retaining the key information to form data representation in NetFlow format; S2.5: According to the real-time network flow change, the features of the nodes and edges in the network threat graph are dynamically updated and detected, and the current network state is reflected by updating the network threat graph in real time.

Images