Network traffic anomaly detection method and system based on time sequence attenuation adaptive edge grouping

Abstract

The invention discloses a network flow anomaly detection method and system based on time sequence attenuation self-adaptive edge grouping. The method comprises the following steps: S1, preprocessing network flow data; s2, constructing network flow interaction graph data; obtaining an original graph structure by taking the network devices as nodes and taking communication behaviors between the network devices as edges; sampling the original image according to the edges, and constructing training image data containing the sampling edges and local sub-images at the two ends of the sampling edges as a model; s3, calculating deep nodes and edge embedding vectors in the graph; after node features and edge features in the graph are initialized, according to a time window and a time sequence attenuation mechanism, designing a heterogeneous edge adaptive grouping graph neural network algorithm to carry out information transmission between nodes and update of edge embedding vectors; s4, calculating a loss function; s3, using a multi-layer perceptron to calculate a final prediction result, inputting the edge embedding vector in the step S3, outputting a prediction score # imgabs0 # through Sigmoid, setting a decision threshold # imgabs1 # to judge whether a target edge is an abnormal edge, and using cross entropy to classify loss for optimization; s5, performing an edge prediction task; data in a network flow data set is divided into a training set, a verification set and a test set, an Adam optimizer is used for updating parameters in a neural network through multiple Epoch training, the performance of a model in each Epoch is recorded, the performance of the model is evaluated, the model with the optimal average performance is stored, and finally a network flow anomaly detection model is obtained.

Description

Technical Field

[0001] The present invention belongs to the field of graph neural networks and computer network security, and relates to a network traffic anomaly detection method and system based on time-series decay adaptive edge grouping. Background Art

[0002] As networks continue to expand and the variety of devices increases, cyberattacks are becoming increasingly complex and diverse, creating increasingly serious network security challenges. Network traffic, as a core component of network security, is the key carrier of communication between different network devices, carrying a wealth of information about network status, communication behavior, and potential attacks. Therefore, network traffic anomaly detection is crucial in ensuring network security.

[0003] Traditional network traffic anomaly detection methods rely on expert-predefined rules, such as threshold detection and regular expression matching, or feature-engineered machine learning models, such as random forests and K-means clustering. These methods rely on manually designed features and are difficult to adapt to diverse network environments and traffic patterns. Furthermore, they analyze only individual traffic records and lack the ability to model global network interaction patterns, making it difficult to capture potential abnormal behavior patterns.

[0004] In recent years, with the rapid development of deep learning technology, researchers have proposed a growing number of deep learning-based methods for detecting network traffic anomalies. Due to the inherent complexity and diversity of network traffic, graph structures, compared to other data structures, can naturally represent the multi-level interactions between devices in a network. The constructed network interaction graphs possess powerful representational capabilities. Consequently, the application of graph neural networks in network traffic anomaly detection has gradually achieved success.

[0005] However, existing graph neural network-based methods mostly focus on processing static node features (such as device IP addresses and ports), while neglecting edge features (such as byte counts and protocol types) that carry more information in actual network traffic, as well as the temporal dynamics of traffic. This leads to the loss of key traffic features. Furthermore, existing graph neural network-based methods often overlook the non-additivity of certain attributes. Non-additivity attributes in edge features (such as maximum value, time, and ratio) easily lose their original semantics after being averaged and aggregated by graph neural networks, resulting in the loss of valid information in specific behavioral patterns. This is particularly evident in scenarios with large traffic variability. For example, the minimum TTL of a packet's lifetime reflects the farthest device in the path, while the maximum TTL reflects the closest device. Directly using the average value obscures path information. Similarly, edges in network flows can be categorized as benign or anomalous. Directly integrating messages from different categories often generates generalized features, compromising the accuracy of message transmission at each layer. Therefore, existing graph neural network-based network traffic anomaly detection methods often rely solely on single-point processing of node information in the network interaction graph, making them incapable of addressing complex and diverse network attacks. Summary of the Invention

[0006] In response to the above problems, the present invention provides a network traffic anomaly detection method and system based on time-series decay adaptive edge grouping.

[0007] This invention takes into account the non-additive properties of network flows and the key information conveyed by edge features. It uses decision tree binning encoding for flow features and fuses neighboring nodes and corresponding edge features during graph neural network aggregation to jointly update the target node. It proposes dynamically grouping and aggregating different types of edges based on time windows and introducing a temporal decay mechanism to better represent complex network behavior patterns. The technical solution of this invention is:

[0008] A first aspect of the present invention relates to a method for detecting network traffic anomalies based on time-degradation adaptive edge grouping, comprising the following steps:

[0009] S1. Network flow data preprocessing: Based on the collected NetFlow format network flow data, IP addresses and ports are standardized. Decision tree binning encoding is used for non-additive flow attributes, and attribute value ranges are dynamically grouped. The remaining flow attributes are targeted and encoded.

[0010] S2. Construct network flow interaction graph data; use network devices as nodes and communication behaviors between network devices as edges to obtain the original graph structure; sample the original graph edge by edge and construct training graph data containing the sampled edges and their local subgraphs at both ends as the model;

[0011] S3. Compute deep node and edge embedding vectors in the graph. After initializing the node and edge features in the graph, design a graph neural network algorithm with adaptive heterogeneous edge grouping based on the time window and temporal decay mechanism to transfer information between nodes and update edge embedding vectors.

[0012] S4. Calculate the loss function; use a multilayer perceptron to calculate the final prediction result, input the edge embedding vector in step S3, and output the prediction score p after Sigmoid. e , set the decision threshold θ to determine whether the target edge is an abnormal edge, and use the cross entropy classification loss for optimization;

[0013] S5. Perform edge prediction tasks; divide the data in the network flow dataset into training, validation, and test sets. Use the Adam optimizer to train over multiple epochs to update the parameters in the neural network. Record the performance of the model in each epoch, evaluate the performance of the model, and save the model with the best average performance to ultimately obtain a network flow anomaly detection model.

[0014] Preferably, step S1 specifically includes:

[0015] The original NetFlow format data mainly includes source / destination IP, source / destination port, protocol type, number of bytes, number of packets, duration, flow rate, etc. Among them, the IP and port attributes are standardized, and some attributes with clear identification or categories (such as protocol type, TCP flag, etc.) are coded by target. Attributes with non-additive properties such as maximum value class, time class, and ratio class are coded by decision tree binning.

[0016] Furthermore, the edge feature decision tree binning encoding processing method is to first standardize the features with non-additivity, and then adopt the decision tree binning strategy to avoid generating generalized meaningless features. Specifically, the decision tree classification is performed by learning the edge label information, and the segmentation condition values are sorted in ascending order, thereby determining the grouping range and number of the edge feature, that is, the grouping is not fixed, but is dynamically adjusted based on the prior probability of the data and the supervisory signal. The trained decision tree assigns the value of each edge feature to different bins according to the split point, and the input edge feature value is converted into one-hot encoding according to these binning boundaries. The original edge feature is represented by Convert to Last updated with new edge feature representation

[0017] Preferably, step S2 specifically includes:

[0018] Using the network flow data preprocessed in step S1, the network devices are taken as nodes, IP and port as node features, the communication behavior between the source node and the destination node is represented as an edge, and other flow features in the network flow record are used as the edge features. Finally, a complete network interaction graph G = {V, E} is generated, where E = {e1, e2, ... e M} represents M edges, V=

[0019] {v1,v2,…v N} represents N nodes, and the edge feature matrix is expressed as Each edge corresponds to d e dimensional features, the node feature matrix is expressed as Each node corresponds to d v dimensional features. The features of the mth edge and the nth node are represented as follows:

[0020]

[0021] The true label of the corresponding edge is y m ∈{0,1}, where 0 represents benign traffic and 1 represents abnormal traffic. Therefore, a set of edge features and true labels can be expressed as: The original graph is sampled by edge, and the training graph data containing the sampled edges and their two-end local subgraphs is constructed as the model.

[0022] Preferably, step S3 specifically includes:

[0023] After obtaining the network flow interaction graph calculated in step S2, the time window is divided and the node and edge embedding vectors are calculated using a graph neural network based on adaptive grouping and aggregation of heterogeneous neighbor edges. The node embedding update incorporates the features of the edge corresponding to the target node. It is characterized by the following steps:

[0024] S31: Based on the prediction results of the model in the previous epoch, all neighbor edges in the current graph are grouped by prediction category, that is, divided into three groups: predicted normal edges, predicted abnormal edges, and all edges. Then, intra-group aggregation and inter-group aggregation are performed respectively.

[0025] S32: Use intra-group aggregation to aggregate all neighbor nodes with the central node. At the same time, introduce a time window and time series decay mechanism, and update node features through the mean aggregation of neighbor messages.

[0026] S33: Use inter-group aggregation and introduce an attention mechanism to aggregate information from all groups and calculate the updated node embedding vector at the current layer;

[0027] S34: Update the edge embedding vector of the target edge based on the concatenation of the node embedding vector of the computing unit and the edge embedding vector of the previous layer.

[0028] Preferably, the neighbor edge grouping in step S31 specifically includes:

[0029] All edges that share an endpoint with the target edge are considered neighbor edges. That is, if edge e = (u, v), then the neighbor edge refers to the edge containing node u or v. Based on the traffic timestamp, the neighbor edges and nodes are divided into time windows T w Perform dynamic grouping. In the network interaction graph, each node u in the time window T w The set of all neighbors of The set of neighbor edges of each central edge e is N(e), which consists of two groups of edges, namely:

[0030]

[0031] in is the edge e in time window T w The set of all neighbor edges of Indicates the In the time window T w The set of neighbor edges of edge e. Classify all edges (including unlabeled edges) and use these classification results to adjust the neighbor grouping in the next round of training. As the classification accuracy of the model continues to improve with training iterations, the grouping results will also be dynamically optimized, thereby improving feature discrimination and model accuracy. Then ε∈ if but Where ε is the neighbor edge of edge e, is the estimated value in the previous Epoch. In the group The set of neighbor nodes associated with the edges in is The edges in the graph can be divided into three groups: all edges, predicted normal edges, and predicted abnormal edges, that is, g∈{*,0,1}.

[0032] Preferably, the time-series attenuation intra-group aggregation method described in step S32 specifically includes:

[0033] First, all neighbor nodes are aggregated with the central node, and a time window and time series decay mechanism are introduced. When aggregating, neighbors within the time window are selected, and a time series decay mechanism is used to set a time series decay weight for the neighbors within the window to prevent historical data from having too much impact on current traffic. An exponential decay function is used:

[0034] α t =e -λ(T-t) ,(Tt)≤T w (2)

[0035] Where T is the current time, t is the neighbor timestamp, and λ is the decay factor. The node features are updated by aggregating the mean of neighbor messages. The specific formula is:

[0036]

[0037] Among them Agg mean represents mean aggregation, || represents feature concatenation, is the weight matrix in the aggregation operation, and ReLU is the activation function.

[0038] For a specific group, Node features are aggregated twice more based on different groups, and the update method is as follows:

[0039]

[0040] Preferably, the intra-group aggregation method described in step S33 specifically includes:

[0041] The attention mechanism is introduced to aggregate the information of all groups and obtain the l-th layer embedding of the node. The calculation formula is:

[0042]

[0043] and is the weight matrix of the two group aggregations, q is the learnable parameter vector, and T represents the transpose operation.

[0044] Preferably, the edge embedding vector updating method described in step S34 specifically includes:

[0045] For each edge e = (u, v) in the network flow interaction graph, the edge embedding vector is updated as follows:

[0046]

[0047] Preferably, step S4 specifically includes:

[0048] After calculation in step S3, the final edge embedding vector is obtained Embed the final edge into vector Input into the multi-layer perceptron MLP to obtain the edge prediction value p e , which represents the probability that an edge is predicted to be anomaly. Cross entropy classification loss is then used for optimization, and the specific formula is as follows:

[0049]

[0050] Use the above model to predict the category of all edges, and generate the corresponding prediction probability p for each edge e , set a decision threshold θ, if p e>θ, then the edge is predicted to be an abnormal network flow (i.e. ); otherwise, it is predicted to be a normal network flow (i.e. ). Finally, the prediction results of all edges are expressed as:

[0051] Preferably, step S5 specifically includes:

[0052] All network flow edges in the network flow dataset are divided into training set, validation set and test set in a ratio of 4:2:4. The Adam optimizer is used to train the neural network parameters through multiple epochs. The performance of the model in each epoch is recorded, and the performance of the model is evaluated using the precision, recall and F1 value. The model with the lowest validation loss is saved for test set prediction, and finally a network flow anomaly detection model is obtained.

[0053] A second aspect of the present invention relates to a network traffic anomaly detection system based on time-series decay adaptive edge grouping, comprising:

[0054] The network flow data preprocessing module includes: based on the collected NetFlow format network flow data, IP addresses and ports are standardized, flow attribute pairs with non-additive properties are encoded using decision tree binning and dynamically grouped into attribute value ranges, and the remaining flow attributes are subjected to target encoding processing;

[0055] The network flow interaction graph data construction module includes: using network devices as nodes and the communication behaviors between network devices as edges to obtain the original graph structure; sampling the original graph by edge, and constructing training graph data containing the sampled edges and the local subgraphs at both ends as the model;

[0056] The module for calculating deep node and edge embedding vectors in the graph includes: after initializing the node and edge features in the graph, a graph neural network method for adaptive grouping of heterogeneous edges is designed based on the time window and time sequence decay mechanism to transmit information between nodes and update the edge embedding vectors;

[0057] The training loss function calculation module includes: using a multi-layer perceptron to calculate the final prediction result, inputting the edge embedding vector in step S3, and outputting the prediction score p after Sigmoid. e , set the decision threshold θ to determine whether the target edge is an abnormal edge, and use the cross entropy classification loss for optimization;

[0058] The edge prediction task module includes: dividing the data in the network flow dataset into training set, validation set and test set, using the Adam optimizer to train through multiple epochs to update the parameters in the neural network, recording the performance of the model in each epoch, evaluating the performance of the model, saving the model with the best average performance, and finally obtaining the network flow anomaly detection model.

[0059] The present invention converts NetFlow network flow data into a graph structure, uses node and edge features to respectively characterize network devices and traffic information, and accurately depicts the communication behavior between network devices. In view of the fact that non-additive attributes in network flow edge features can easily lead to the loss of effective information during average aggregation in graph neural networks, a decision tree dynamic binning strategy is used to process edge features to avoid generating generalized features. Considering that the edges in the network flow interaction graph contain most of the traffic information, the edge features are deeply integrated with node message transmission to avoid losing key features in network traffic. The time window and timing decay mechanism are introduced to improve the sensitivity to the timing characteristics of traffic data. At the same time, through the mechanism of adaptive grouping and aggregation of different types of neighbor edges, the model can adaptively distinguish the contributions of different edge groups, focus on abnormal traffic patterns while retaining global topology information, significantly improve the accuracy of anomaly detection, and provide a reliable solution for network flow anomaly detection.

[0060] The advantages of this invention are: by converting NetFlow network flow data into a graph structure, node and edge features are used to represent network devices and traffic information respectively, accurately depicting the communication behavior between network devices. To address the non-additive properties of network flow edge features, which can easily lead to loss of effective information during average aggregation in graph neural networks, especially in scenarios with large fluctuations in traffic information, a decision tree binning strategy is used to process edge features to avoid generating generalized features. Considering that edges in network flow interaction graphs contain the vast majority of traffic information, edge features are deeply integrated with node messaging to avoid losing key features of network traffic. A time window and time series decay mechanism are introduced to improve the model's sensitivity to the temporal characteristics of traffic data. Furthermore, by grouping and aggregating neighboring edges, the model can adaptively distinguish the contributions of different edge groups, focusing on anomalous traffic patterns while preserving global topology information, significantly improving the accuracy of anomaly detection. Finally, a diversified model evaluation method is used, comprehensively considering multiple metrics such as precision, recall, and F1 score to more comprehensively evaluate model performance, ensuring its robustness and practicality in complex network environments, providing an efficient and reliable solution for network flow anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 It is a schematic diagram of converting original network flow data into graph data according to the present invention;

[0062] Figure 2It is a schematic diagram of neighbor edge grouping and aggregation within the time window of the present invention. DETAILED DESCRIPTION

[0063] The following is a further detailed description of the present invention in conjunction with the accompanying drawings. It should be understood that the embodiments described herein are intended only to illustrate the present invention and are not intended to limit the scope of the present invention. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without inventive effort are intended to fall within the scope of protection of the present invention.

[0064] It should be noted that, unless there is any conflict, the features in the following embodiments and implementations may be combined with each other.

[0065] Example 1

[0066] This embodiment relates to a network traffic anomaly detection method based on time-series decay adaptive edge grouping, comprising the following steps:

[0067] S1. Network flow data preprocessing;

[0068] The benchmark NIDS dataset NF-UNSW-NB15 based on NetFlow is used. The original NetFlow format data mainly includes source / destination IP, source / destination port, protocol type, number of bytes, number of packets, duration, flow rate, etc. Figure 1 As shown in the table in . In order to adapt to the actual operating environment, 10% of the original data is randomly selected as the data set for this experiment. This data set has a significant imbalance characteristic (normal samples account for >95%), and the attack types are diverse, which conforms to the traffic characteristics of real network scenarios and can effectively verify the model's anomaly detection capabilities in complex network environments. Among them, the IP and port attributes are standardized, and some attributes with clear identification or categories (such as protocol type, TCP flag, etc.) are encoded by target, and attributes with non-additive properties such as maximum value class, time class, and ratio class are encoded by decision tree binning. Decision tree classification is performed by learning label information, and the split condition values are sorted in ascending order to determine the grouping range and number of the feature. The input feature value is converted to one-hot encoding according to the bin boundary, and the original edge feature is encoded by Convert to Last updated with new edge feature representation

[0069] S2. Construct network flow interaction graph data;

[0070] Using the network flow data preprocessed in step S1, the network devices are taken as nodes, IP and port as node features, the communication behavior between the source node and the destination node is represented as an edge, and other flow features in the network flow record are used as the edge features. Finally, a complete network interaction graph G = {V, E} is generated, where E = {e1, e2, ... e M} represents M edges, V=

[0071] {v1,v2,…v N} represents N nodes, and the edge feature matrix is expressed as Each edge corresponds to d e dimensional features, the node feature matrix is expressed as Each node corresponds to d v dimensional features. The features of the mth edge and the nth node are represented as follows:

[0072]

[0073] The true label of the corresponding edge is y m ∈{0,1}, where 0 represents benign traffic and 1 represents abnormal traffic. Therefore, a set of edge features and true labels can be expressed as: The original graph is sampled by edge, and the training graph data containing the sampled edges and their two-end local subgraphs is constructed as the model.

[0074] S3. Compute deep node and edge embedding vectors in the graph;

[0075] After obtaining the initialized network flow interaction graph, in the network interaction graph, each node u in the time window T w The set of all neighbors of The set of neighbor edges of each central edge e is N(e), which consists of two groups of edges, namely:

[0076]

[0077] in is the edge e in time window T w The set of all neighbor edges of Indicates the In the time window T w The set of neighbor edges of edge e. At the end of each training Epoch, all edges (including unlabeled edges) are classified according to the prediction results of the current model, and these classification results are used to adjust the neighbor grouping in the next round of training.

[0078] Furthermore, when aggregating, neighbors within the time window are selected, and a time decay mechanism is adopted to set time decay weights for neighbors within the window to prevent historical data from having too much impact on current traffic. An exponential decay function is used:

[0079]

[0080] Where T is the current time, t is the neighbor timestamp, and λ is the decay factor.

[0081] Furthermore, if but if Then ε∈

[0082] Where ε is the neighbor edge of edge e, is the estimated value in the previous Epoch. In the group The set of neighbor nodes associated with the middle edge is The edges in the graph can be divided into three groups: all edges, predicted normal edges, and predicted abnormal edges, i.e. g∈{*,0,1}. For the three groups of edges divided into g∈{*,0,1}, intra-group aggregation and inter-group aggregation are performed respectively. The aggregation process is shown in the attached figure. Figure 2 shown.

[0083] Furthermore, the intra-group aggregation method is to first aggregate all neighbor nodes with the central node, introduce a time window and a time sequence decay mechanism, and update the node features by aggregating the mean of neighbor messages. The specific formula is:

[0084]

[0085] Among them Agg mean represents mean aggregation, || represents feature concatenation, is the weight matrix in the aggregation operation, and ReLU is the activation function.

[0086] For a specific group, Node features are aggregated twice more based on different groups, and the update method is as follows:

[0087]

[0088] Furthermore, the inter-group aggregation method is defined as introducing an attention mechanism to aggregate information from all groups to obtain the l-th layer embedding of the node. The specific calculation formula is:

[0089]

[0090] and is the weight matrix of the two group aggregations, q is the learnable parameter vector, and T represents the transpose operation.

[0091] Furthermore, for each edge e = (u, v), the edge embedding vector is updated as follows:

[0092]

[0093] S4. Calculate the loss function;

[0094] After the above group aggregation calculation, the final edge embedding vector is obtained Embed the final edge into vector Input into the multi-layer perceptron MLP to obtain the edge prediction value p e , which represents the probability that an edge is predicted to be anomaly. Cross entropy classification loss is then used for optimization, and the loss function is defined as:

[0095]

[0096] Use the above model to predict the category of all edges, and generate the corresponding prediction probability p for each edge e , set a decision threshold θ, if p e >θ, then the edge is predicted to be an abnormal network flow (i.e. ); otherwise, it is predicted to be a normal network flow (i.e. ).

[0097] Finally, the prediction results of all edges are expressed as:

[0098] S5. Perform edge prediction task;

[0099] Furthermore, all network flow edges in the network flow dataset are divided into training set, validation set and test set in a ratio of 4:2:4. The Adam optimizer is used to train the neural network through multiple epochs to update the parameters. The performance of the model in each epoch is recorded, and the performance of the model is evaluated using the precision, recall and F1 value. The model with the lowest validation loss is saved for test set prediction, and finally a network flow anomaly detection model is obtained.

[0100] In this embodiment, in an extremely unbalanced network flow data scenario where normal traffic accounts for more than 95%, the verification results are shown in the following table:

[0101]

[0102] The method proposed in the present invention is significantly improved compared to NEGSC (non-patent literature Xu, Renjie, et al. "Applying self-supervised learning to network intrusion detection for network flows with graph neural network." Computer Networks 248(2024):110495.). The model of the present invention achieves an F1 value, recall rate and precision of abnormal traffic of 0.8432, 0.8783 and 0.8110, respectively, which are 36.8%, 50.3% and 24.3% higher than the corresponding indicators of NEGSC (0.6165, 0.5844, 0.6524). This shows that the network traffic anomaly detection method proposed in the present invention can more accurately identify abnormal traffic when processing unbalanced network traffic data sets, especially in scenarios with diverse attack types and large traffic fluctuations, showing stronger robustness and accuracy.

[0103] The foregoing is intended only to illustrate the embodiments of the present invention and is not intended to limit the present invention. It will be apparent to those skilled in the art that various modifications and variations may be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention shall be included within the scope of protection of the claims of the present invention.

Claims

1. A network traffic anomaly detection method based on time-series decay adaptive edge grouping, comprising the following steps: S1. Network flow data preprocessing: Based on the collected NetFlow format network flow data, IP addresses and ports are standardized. Decision tree binning encoding is used for non-additive flow attributes, and attribute value ranges are dynamically grouped. The remaining flow attributes are targeted and encoded. S2. Construct network flow interaction graph data; use network devices as nodes and communication behaviors between network devices as edges to obtain the original graph structure; sample the original graph edge by edge and construct training graph data containing the sampled edges and their local subgraphs at both ends as the model; S3. Compute deep node and edge embedding vectors in the graph. After initializing the node and edge features in the graph, design a graph neural network algorithm with adaptive heterogeneous edge grouping based on the time window and temporal decay mechanism to transfer information between nodes and update edge embedding vectors. S4. Calculate the loss function; use a multilayer perceptron to calculate the final prediction result, input the edge embedding vector in step S3, and output the prediction score p after Sigmoid. e , set the decision threshold θ to determine whether the target edge is an abnormal edge, and use the cross entropy classification loss for optimization; S5. Perform edge prediction tasks; divide the data in the network flow dataset into training, validation, and test sets. Use the Adam optimizer to train over multiple epochs to update the parameters in the neural network. Record the performance of the model in each epoch, evaluate the performance of the model, and save the model with the best average performance to ultimately obtain a network flow anomaly detection model.

2. The network traffic anomaly detection method based on time-series decay adaptive edge grouping according to claim 1, characterized in that: Step S1 specifically includes: the original NetFlow format data mainly includes source / destination IP, source / destination port, protocol type, number of bytes, number of packets, duration, flow rate, etc., among which IP and port attributes are standardized, some attributes with clear identification or category are encoded by target, and attributes with non-additive properties such as maximum value class, time class, ratio class are encoded by decision tree binning; decision tree classification is performed by learning label information, and the segmentation condition values are sorted in ascending order to determine the grouping range and number of the feature; the input feature value is converted into one-hot encoding according to the bin boundary, and the original edge feature is encoded by Convert to Last updated with new edge feature representation 3. The network traffic anomaly detection method based on time-series decay adaptive edge grouping according to claim 1, characterized in that: Step S2 specifically includes: using the network flow data preprocessed in step S1, taking network devices as nodes, IP and port as node features, the communication behavior between the source node and the destination node as edges, and other flow features in the network flow record as the edge features, and finally generating a complete network interaction graph G = {V, E}, where E = {e1,e2,…e M } represents M edges, V={v1,v2,…v N } represents N nodes, and the edge feature matrix is expressed as Each edge corresponds to d e dimensional features, the node feature matrix is expressed as Each node corresponds to d v dimensional features; the representations of the features of the m-th edge and the n-th node are: The true label of the corresponding edge is y m ∈{0,1}, where 0 represents benign traffic and 1 represents abnormal traffic; therefore, a set of edge features and true labels can be expressed as: The original graph is sampled by edge, and the training graph data containing the sampled edges and their two-end local subgraphs is constructed as the model.

4. The network traffic anomaly detection method based on time-series decay adaptive edge grouping according to claim 1, characterized in that: Step S3 specifically includes: after obtaining the network flow interaction graph calculated in step S2, dividing the time window, and using a graph neural network based on adaptive grouping and aggregation of heterogeneous neighbor edges to calculate node and edge embedding vectors. The node embedding update incorporates the features of the edge corresponding to the target node, specifically including the following steps: S31: Based on the prediction results of the model in the previous epoch, all neighbor edges in the current graph are grouped by prediction category, that is, divided into three groups: predicted normal edges, predicted abnormal edges, and all edges. Then, intra-group aggregation and inter-group aggregation are performed respectively. S32: Use intra-group aggregation to aggregate all neighbor nodes with the central node. At the same time, introduce a time window and time series decay mechanism, and update node features through the mean aggregation of neighbor messages. S33: Use inter-group aggregation and introduce an attention mechanism to aggregate information from all groups and calculate the updated node embedding vector at the current layer; S34: Update the edge embedding vector of the target edge based on the concatenation of the node embedding vector of the computing unit and the edge embedding vector of the previous layer.

5. The network traffic anomaly detection method based on time-series decay adaptive edge grouping according to claim 4 is characterized in that: The neighbor edge grouping in step S31 specifically includes: taking all edges that share an endpoint with the target edge as neighbor edges, that is, if edge e = (u, v), then the neighbor edge refers to the edge containing node u or v; according to the traffic timestamp, the neighbor edges and nodes are grouped according to the time window T w Dynamic grouping; in the network interaction graph, each node u in the time window T w The set of all neighbors of The set of neighbor edges of each central edge e is N(e), which consists of two groups of edges, namely: in is the edge e in time window T w The set of all neighbor edges of Indicates the In the time window T w The set of neighbor edges of edge e; at the end of each training Epoch, all edges are classified according to the prediction results of the current model, and these classification results are used to adjust the neighbor grouping in the next round of training. but if but Where ε is the neighbor edge of edge e, is the estimated value in the previous Epoch; node u is In the group The set of neighbor nodes associated with the edges in is The edges in the graph can be divided into three groups: all edges, predicted normal edges, and predicted abnormal edges, that is, g∈{*,0,1}.

6. The network traffic anomaly detection method based on time-series decay adaptive edge grouping according to claim 4, characterized in that: The time-series attenuation group aggregation method described in step S32 specifically includes: first, aggregating all neighbor nodes with the central node, while introducing a time window and a time decay mechanism; selecting neighbors within the time window during aggregation, and using the time decay mechanism to set time decay weights for neighbors within the window to prevent historical data from having too much impact on current traffic; using an exponential decay function: a t =e -λ(T-t) ,(Tt)≤T w (2) Where T is the current time, t is the neighbor timestamp, and λ is the decay factor. The node features are updated by aggregating the mean of neighbor messages. The specific formula is: Among them Agg mean represents mean aggregation, || represents feature concatenation, is the weight matrix in the aggregation operation, and ReLU is the activation function; For a specific group, Node features are aggregated twice more based on different groups, and the update method is as follows:

7. The network traffic anomaly detection method based on time-series decay adaptive edge grouping according to claim 4, characterized in that: The inter-group aggregation method described in step S33 specifically includes: introducing an attention mechanism to aggregate information from all groups and obtaining the l-th layer embedding of the node. The calculation formula is: and is the weight matrix of the two group aggregations, q is the learnable parameter vector, and T represents the transpose operation; The edge embedding vector update in step S34 specifically includes: for each edge e=(u,v) in the network flow interaction graph, the edge embedding vector is updated in the following manner:

8. The network traffic anomaly detection method based on time-series decay adaptive edge grouping according to claim 1, characterized in that: Step S4 specifically includes: embedding the final edge into vector Input into the multi-layer perceptron MLP to obtain the edge prediction value p e , which represents the probability that the edge is predicted to be abnormal; cross entropy classification loss is then used for optimization, and the specific formula is as follows: Use the above model to predict the category of all edges, and generate the corresponding prediction probability p for each edge e , set a decision threshold θ, if p e >θ, then the edge is predicted to be an abnormal network flow, i.e. Otherwise, it is predicted as normal network flow, i.e. Finally, the prediction results of all edges are expressed as:

9. The network traffic anomaly detection method based on time-series decay adaptive edge grouping according to claim 1, characterized in that: Step S5 specifically includes: dividing all network flow edges in the network flow dataset into training set, validation set and test set in a ratio of 4:2:4, using the Adam optimizer to train through multiple epochs to update the parameters in the neural network, recording the performance of the model in each epoch, using the precision, recall and F1 value to evaluate the performance of the model, saving the model with the lowest validation loss for test set prediction, and finally obtaining the network flow anomaly detection model.

10. A network traffic anomaly detection system based on time-series decay adaptive edge grouping, characterized in that: include: The network flow data preprocessing module includes: based on the collected NetFlow format network flow data, IP addresses and ports are standardized, flow attribute pairs with non-additive properties are encoded using decision tree binning and dynamically grouped into attribute value ranges, and the remaining flow attributes are subjected to target encoding processing; The network flow interaction graph data construction module includes: using network devices as nodes and the communication behaviors between network devices as edges to obtain the original graph structure; sampling the original graph by edge, and constructing training graph data containing the sampled edges and the local subgraphs at both ends as the model; The module for calculating deep node and edge embedding vectors in the graph includes: after initializing the node and edge features in the graph, a graph neural network method for adaptive grouping of heterogeneous edges is designed based on the time window and time sequence decay mechanism to transmit information between nodes and update the edge embedding vectors; The training loss function calculation module includes: using a multi-layer perceptron to calculate the final prediction result, inputting the edge embedding vector in step S3, and outputting the prediction score p after Sigmoid. e , set the decision threshold θ to determine whether the target edge is an abnormal edge, and use the cross entropy classification loss for optimization; The edge prediction task module includes: dividing the data in the network flow dataset into training set, validation set and test set, using the Adam optimizer to train through multiple epochs to update the parameters in the neural network, recording the performance of the model in each epoch, evaluating the performance of the model, saving the model with the best average performance, and finally obtaining the network flow anomaly detection model.

Images