Network traffic anomaly detection method and system based on timing decay adaptive edge grouping

Abstract

A network traffic anomaly detection method and system based on time-decay adaptive edge grouping is proposed. The method includes: S1. Network flow data preprocessing; S2. Constructing network flow interaction graph data; using network devices as nodes and communication behaviors between network devices as edges to obtain the original graph structure; sampling the original graph by edges and constructing training graph data containing the sampled edges and their two local subgraphs as model training data; S3. Calculating the embedding vectors of deep nodes and edges in the graph; after initializing the node and edge features in the graph, a graph neural network algorithm with heterogeneous edge adaptive grouping is designed based on the time window and time-decay mechanism to perform information transmission between nodes and edge embedding vectors. Update; S4. Calculate the loss function; Use a multilayer perceptron to calculate the final prediction result. Input the edge embedding vector from step S3, and output the prediction score after passing through the Sigmoid function. Set a decision threshold to determine whether the target edge is an anomalous edge. Use cross-entropy classification loss for optimization; S5. Perform the edge prediction task; Divide the data in the network flow dataset into training, validation, and test sets. Use the Adam optimizer to train for multiple epochs to update the parameters in the neural network. Record the model performance in each epoch, evaluate the model performance, save the model with the best average performance, and finally obtain the network flow anomaly detection model.

Description

Technical Field

[0001] This invention belongs to the fields of graph neural networks and computer network security, and relates to a method and system for detecting network traffic anomalies based on time-decay adaptive edge grouping. Background Technology

[0002] As networks continue to expand and the variety of devices increases, cyberattacks are becoming more complex and diverse, making cybersecurity a more serious issue. Network traffic, as a core component of network security, is a crucial carrier of communication between different network devices, containing a wealth of information about network status, communication behavior, and potential attacks. Therefore, anomaly detection in network traffic is essential for ensuring network security.

[0003] Traditional methods for detecting network traffic anomalies include those based on expert-defined rules, such as threshold detection and regular expression matching, or machine learning models based on feature engineering, such as random forests and K-means clustering. These methods rely on manually designed features, making it difficult to adapt to different network environments and traffic patterns. Furthermore, they analyze only individual traffic records, lacking the ability to model global network interaction patterns and thus failing to capture potential abnormal behavior patterns.

[0004] In recent years, with the rapid development of deep learning technology, researchers have proposed an increasing number of deep learning-based methods for network traffic anomaly detection. Due to the complexity and diversity of network traffic itself, graph structures, compared to other data structures, can naturally represent the multi-level interaction relationships between devices in a network, and the constructed network interaction graphs possess powerful representational capabilities. Therefore, graph neural networks have gradually achieved success in the application of network traffic anomaly detection.

[0005] However, existing graph neural network-based methods mostly focus on processing static node features (such as device IP addresses and ports), neglecting edge features (such as byte count and protocol type) and the temporal dynamics of traffic, which carry more information in actual network traffic. This leads to the loss of key features in the traffic. At the same time, existing graph neural network methods often ignore the non-additivity of certain attributes. Non-additive attributes in edge features (such as extrema, time, and ratio attributes) are prone to losing their original semantics after being averaged and aggregated by graph neural networks, resulting in the loss of effective information in specific behavioral patterns, especially in scenarios with large traffic variations. For example, regarding the time-to-live (TTL) of a data packet, the minimum TTL reflects the device with the furthest path, while the maximum TTL reflects the closest device; directly using the average will obscure the path information. Similarly, edges in network flows can be divided into benign and anomalous types, and directly integrating messages from different categories often generates generalized features, thereby impairing the accuracy of message transmission at each layer. Therefore, existing graph neural network-based network traffic anomaly detection methods often rely solely on the processing of node information in the network interaction graph, making them difficult to cope with complex and ever-changing network attacks. Summary of the Invention

[0006] To address the above problems, this invention provides a method and system for detecting network traffic anomalies based on time-decay adaptive side-packing.

[0007] This invention considers the non-additivity property of network flows and the key information transmitted by edge features. It employs decision tree binning encoding for flow features and fuses neighbor nodes and corresponding edge features to jointly update the target node during graph neural network aggregation. Furthermore, it proposes dynamically grouping and aggregating different types of edges based on time windows and introducing a temporal decay mechanism to better represent complex network behavior patterns. The technical solution of this invention is:

[0008] The first aspect of this invention relates to a network traffic anomaly detection method based on time-decrease adaptive side-packets, comprising the following steps:

[0009] S1. Network flow data preprocessing: Based on the collected NetFlow format network traffic data, IP addresses and ports are standardized, and non-additive flow attributes are binned using decision tree encoding and dynamically grouped into attribute value ranges. The remaining flow attributes are target encoded.

[0010] S2. Construct network flow interaction graph data; using network devices as nodes and communication behaviors between network devices as edges, obtain the original graph structure; sample the original graph by edges, and construct training graph data containing the sampled edges and their two local subgraphs as the model;

[0011] S3. Calculate the embedding vectors of deep nodes and edges in the graph; after initializing the node features and edge features in the graph, design a graph neural network algorithm with heterogeneous edge adaptive grouping based on the time window and time-series decay mechanism to perform information transmission between nodes and update edge embedding vectors.

[0012] S4. Calculate the loss function; use a multilayer perceptron to calculate the final prediction result, inputting the edge embedding vector from step S3, and outputting the prediction score p after passing through the Sigmoid function. e Set a decision threshold θ to determine whether the target edge is an abnormal edge, and use cross-entropy classification loss for optimization;

[0013] S5. Perform edge prediction task; divide the data in the network flow dataset into training set, validation set and test set, use Adam optimizer to train for multiple epochs to update the parameters in the neural network, record the model performance in each epoch, evaluate the model performance, save the model with the best average performance, and finally obtain the network flow anomaly detection model.

[0014] Preferably, step S1 specifically includes:

[0015] The raw NetFlow format data mainly includes source / destination IP, source / destination port, protocol type, number of bytes, number of packets, duration, and flow rate. Among them, IP and port attributes are standardized, some attributes with clear identifiers or categories (such as protocol type, TCP flag, etc.) are target-encoded, and attributes with non-additivity such as extrema, time, and ratio are binned using decision tree encoding.

[0016] Furthermore, the edge feature decision tree binning encoding method first standardizes features with non-additivity, and then employs a decision tree binning strategy to avoid generating generalized meaningless features. Specifically, decision tree classification is performed by learning edge label information, and the splitting condition values ​​are sorted in ascending order, thereby determining the grouping range and number of edge features. That is, the grouping is not fixed, but dynamically adjusted based on the prior probability of the data and the supervision signal. The trained decision tree assigns the value of each edge feature to different bins according to the splitting point. The input edge feature values ​​are converted into one-hot encoding according to these bin boundaries, and the original edge features are... Convert to Finally, it is updated to a new edge feature representation.

[0017] Preferably, step S2 specifically includes:

[0018] Using the preprocessed network flow data from step S1, with network devices as nodes, IP addresses and ports as node features, and the communication behavior between the source and destination nodes represented as edges, and other flow features in the network flow records as edge features, a complete network interaction graph G = {V, E} is finally generated, where E = {e1, e2, ... e... M} represents M edges, V =

[0019] {v1,v2,…v N} represents N nodes, and the edge feature matrix is ​​represented as Each edge corresponds to d e 3D features, the node feature matrix is ​​represented as Each node corresponds to d v Dimensional features. The features of the m-th edge and the n-th node are represented as follows:

[0020]

[0021] The actual label of the corresponding edge is y m ∈{0,1}, where 0 represents benign traffic and 1 represents abnormal traffic. Therefore, a set of edge features and true labels can be represented as follows: The original graph is sampled by edges, and the sampled edges and their local subgraphs at both ends are constructed as training graph data for the model.

[0022] Preferably, step S3 specifically includes:

[0023] After obtaining the network flow interaction graph calculated in step S2, a time window is divided, and a graph neural network based on heterogeneous neighbor edge adaptive grouping and aggregation is used to calculate the node and edge embedding vectors. The node embedding update incorporates the features of the edge corresponding to the target node. Specifically, it includes the following steps:

[0024] S31: Based on the prediction results of the model in the previous Epoch, group all neighbor edges in the current graph according to the prediction category, namely, predict normal edges, predict abnormal edges, and all edges, and then perform intra-group aggregation and inter-group aggregation respectively.

[0025] S32: Intra-group aggregation is used to aggregate all neighbor nodes with the central node once, while introducing a time window and time-series decay mechanism, and updating node characteristics by aggregating the average of neighbor messages;

[0026] S33: Use inter-group aggregation and introduce an attention mechanism to gather information from all groups and calculate the updated node embedding vector in the current layer;

[0027] S34: The edge embedding vector of the target edge is updated by concatenating the node embedding vector of the computation unit with the edge embedding vector of the previous layer.

[0028] Preferably, the neighbor edge grouping in step S31 specifically includes:

[0029] All edges sharing an endpoint with the target edge are considered neighbor edges. That is, if edge e = (u, v), then a neighbor edge is an edge containing either node u or v. Based on the flow timestamp, neighbor edges and nodes are arranged according to a time window T. w Dynamic grouping is performed. In the network interaction graph, each node u is in time window T. w The set of all neighbors is The set of neighboring edges for each central edge e is N(e), which consists of two sets of edges:

[0030]

[0031] in Is edge e in time window T? w The set of all neighboring edges, Indicates the first In the group within the time window T w The set of neighbor edges of edge e. All edges (including unlabeled edges) are classified, and these classification results are used to adjust the neighbor groupings in the next training round. Since the model's classification accuracy improves with each training iteration, the grouping results also dynamically optimize, thereby improving feature discrimination and model accuracy. If Then ε∈ if but Where ε is the neighboring edge of edge e. This is the estimate from the previous epoch. Node u is in the epoch. In the group and The set of neighbor nodes related to the edge in the equation is: The edges in the graph can be divided into three groups: all edges, predicted normal edges, and predicted abnormal edges, i.e., g∈{*,0,1}.

[0032] Preferably, the time-decay group aggregation method described in step S32 specifically includes:

[0033] First, all neighbor nodes are aggregated with the central node, while introducing a time window and a time-series decay mechanism. During aggregation, neighbors within the time window are selected, and a time-series decay mechanism is applied, assigning a decay weight to each neighbor within the window to prevent historical data from having an excessive impact on current traffic. An exponential decay function is used:

[0034] α t =e -λ(T-t) ,(Tt)≤T w (2)

[0035] Where T is the current time, t is the neighbor timestamp, and λ is the decay factor. Node features are updated by aggregating the mean of neighbor messages, using the following formula:

[0036]

[0037] Among them Agg mean || represents mean aggregation, and || represents feature concatenation. It is the weight matrix in the aggregation operation, and ReLU is the activation function.

[0038] For a specific group The node features will be aggregated twice more based on different groups, and the update method is as follows:

[0039]

[0040] Preferably, the intra-group aggregation method described in step S33 specifically includes:

[0041] An attention mechanism is introduced to gather information from all groups and obtain the l-th layer embedding of a node. The calculation formula is as follows:

[0042]

[0043] and It is the weight matrix for the two grouping and aggregation operations, q is the learnable parameter vector, and T represents the transpose operation.

[0044] Preferably, the edge embedding vector update method in step S34 specifically includes:

[0045] For each edge e = (u, v) in the network flow interaction graph, the edge embedding vector is updated as follows:

[0046]

[0047] Preferably, step S4 specifically includes:

[0048] After calculation in step S3, the final edge embedding vector is obtained. The final edge embedding vector The input is fed into a multilayer perceptron (MLP) to obtain the edge prediction value p. e , representing the probability that an edge is predicted as an anomaly. Then, cross-entropy classification loss is used for optimization, with the specific formula as follows:

[0049]

[0050] The above model is used to predict the category of all edges, and a corresponding predicted probability p is generated for each edge. e Set a decision threshold θ, if p eIf the edge is greater than θ, then the edge is predicted as an anomalous network flow (i.e., ...). Conversely, it is predicted as normal network flow (i.e., ...). Finally, the prediction results for all edges are expressed as follows:

[0051] Preferably, step S5 specifically includes:

[0052] All network flow edges in the network flow dataset are partitioned into training, validation, and test sets in a 4:2:4 ratio. The Adam optimizer is used to train the neural network through multiple epochs to update the parameters. The model performance in each epoch is recorded, and the performance of the model is evaluated using precision, recall, and F1 score. The model with the lowest validation loss is saved for prediction on the test set, and finally, a network flow anomaly detection model is obtained.

[0053] A second aspect of the present invention relates to a network traffic anomaly detection system based on time-decrease adaptive sidepacking, comprising:

[0054] The network flow data preprocessing module includes: standardizing IP addresses and ports based on the collected NetFlow format network traffic data; using decision tree binning encoding and dynamically grouping attribute value ranges for non-additive flow attributes; and performing target encoding processing on the remaining flow attributes.

[0055] The network flow interaction graph data construction module includes: taking network devices as nodes and communication behaviors between network devices as edges to obtain the original graph structure; sampling the original graph by edges and constructing training graph data containing the sampled edges and their two local subgraphs as models;

[0056] The module for calculating deep node and edge embedding vectors in a graph includes: after initializing the node and edge features in the graph, a graph neural network method for adaptive grouping of heterogeneous edges is designed based on the time window and time-series decay mechanism to perform information transmission between nodes and update edge embedding vectors;

[0057] The training loss function calculation module includes: using a multilayer perceptron to calculate the final prediction result, taking the edge embedding vector from step S3 as input, and outputting a prediction score p after passing it through a sigmoid function. e Set a decision threshold θ to determine whether the target edge is an abnormal edge, and use cross-entropy classification loss for optimization;

[0058] The edge prediction task module includes: dividing the data in the network flow dataset into training, validation and test sets, using the Adam optimizer to train for multiple epochs to update the parameters in the neural network, recording the model performance in each epoch, evaluating the model performance, saving the model with the best average performance, and finally obtaining the network flow anomaly detection model.

[0059] This invention transforms NetFlow network flow data into a graph structure, using node and edge features to represent network device and traffic information respectively, accurately depicting the communication behavior between network devices. To address the issue that non-additive attributes in network flow edge features can easily lead to the loss of effective information during average aggregation in graph neural networks, a decision tree dynamic binning strategy is employed to process edge features, avoiding the generation of generalized features. Considering that edges in the network flow interaction graph contain the majority of traffic information, edge features are deeply fused with node message passing to avoid losing key features in network traffic. A time window and time-series decay mechanism are introduced to improve the sensitivity to the temporal characteristics of traffic data. Simultaneously, through an adaptive grouping and aggregation mechanism of different types of neighbor edges, the model can adaptively distinguish the contributions of different edge groups, focusing on abnormal traffic patterns while preserving global topology information, significantly improving the accuracy of anomaly detection, and providing a reliable solution for network flow anomaly detection.

[0060] The advantages of this invention are: by transforming NetFlow network flow data into a graph structure, and using node and edge features to represent network devices and traffic information respectively, it accurately depicts the communication behavior between network devices. To address the issue that non-additive attributes in network flow edge features can easily lead to the loss of effective information during average aggregation in graph neural networks, especially in scenarios with large fluctuations in traffic information, a decision tree binning strategy is adopted to process edge features, avoiding the generation of generalized features. Considering that edges in the network flow interaction graph contain most of the traffic information, edge features are deeply fused with node message passing to avoid losing key features in network traffic. A time window and time-series decay mechanism are introduced to improve the model's sensitivity to the temporal characteristics of traffic data. Simultaneously, through a neighbor edge grouping and aggregation mechanism, the model can adaptively distinguish the contributions of different types of edge groups, focusing on abnormal traffic patterns while preserving global topology information, significantly improving the accuracy of anomaly detection. Finally, diverse model evaluation methods are employed, comprehensively considering multiple indicators such as precision, recall, and F1 score, to more comprehensively evaluate model performance, ensuring its robustness and practicality in complex network environments, providing an efficient and reliable solution for network flow anomaly detection. Attached Figure Description

[0061] Figure 1 This is a schematic diagram illustrating the conversion of raw network flow data into graph data according to the present invention;

[0062] Figure 2This is a schematic diagram of neighbor edge grouping and aggregation within the time window of the present invention. Detailed Implementation

[0063] The following detailed description, in conjunction with the accompanying drawings and specific embodiments of the present invention, provides a further detailed explanation. Clearly, the described embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0064] It should be noted that, unless otherwise specified, the features in the following embodiments and implementation methods can be combined with each other.

[0065] Example 1

[0066] This embodiment relates to a network traffic anomaly detection method based on time-decay adaptive edge grouping, which includes the following steps:

[0067] S1. Network stream data preprocessing;

[0068] The benchmark NIDS dataset NF-UNSW-NB15 based on NetFlow was used. The original NetFlow format data mainly includes source / destination IP, source / destination port, protocol type, number of bytes, number of packets, duration, and traffic rate, as shown in the attached figure. Figure 1 The table below shows the results. To adapt to the actual operating environment, 10% of the original data was randomly selected as the dataset for this experiment. This dataset has significant imbalance characteristics (normal samples account for >95%) and diverse attack types, which conforms to the traffic characteristics of real network scenarios and can effectively verify the model's anomaly detection capability in complex network environments. IP and port attributes were standardized, and some attributes with clear identifiers or categories (such as protocol type, TCP flags, etc.) used target encoding. Attributes with non-additive properties, such as extrema, time, and ratios, used decision tree binning encoding. Decision tree classification was performed by learning label information, and the splitting condition values ​​were sorted in ascending order to determine the grouping range and number of features. The input feature values ​​were converted to one-hot encoding according to the binning boundaries, and the original edge features were... Convert to Finally, it is updated to a new edge feature representation.

[0069] S2. Construct network flow interaction graph data;

[0070] Using the preprocessed network flow data from step S1, with network devices as nodes, IP addresses and ports as node features, and the communication behavior between the source and destination nodes represented as edges, and other flow features in the network flow records as edge features, a complete network interaction graph G = {V, E} is finally generated, where E = {e1, e2, ... e... M} represents M edges, V =

[0071] {v1,v2,…v N} represents N nodes, and the edge feature matrix is ​​represented as Each edge corresponds to d e 3D features, the node feature matrix is ​​represented as Each node corresponds to d v Dimensional features. The features of the m-th edge and the n-th node are represented as follows:

[0072]

[0073] The actual label of the corresponding edge is y m ∈{0,1}, where 0 represents benign traffic and 1 represents abnormal traffic. Therefore, a set of edge features and true labels can be represented as follows: The original graph is sampled by edges, and the sampled edges and their local subgraphs at both ends are constructed as training graph data for the model.

[0074] S3. Calculate the embedding vectors of deep nodes and edges in the graph;

[0075] After obtaining the initialized network flow interaction graph, in the network interaction graph, each node u in the time window T w The set of all neighbors is The set of neighboring edges for each central edge e is N(e), which consists of two sets of edges:

[0076]

[0077] in Is edge e in time window T? w The set of all neighboring edges, Indicates the first In the group within the time window T w The set of neighbor edges of edge e. At the end of each training epoch, all edges (including unlabeled edges) are classified based on the predictions of the current model, and these classification results are used to adjust the neighbor groupings in the next training round.

[0078] Furthermore, during aggregation, neighbors within the time window are selected, and a time-series decay mechanism is employed. A time-series decay weight is assigned to neighbors within the window to prevent historical data from having an excessive impact on current traffic. An exponential decay function is used.

[0079]

[0080] Where T is the current time, t is the neighbor timestamp, and λ is the decay factor.

[0081] Furthermore, if but if Then ε∈

[0082] Where ε is the neighboring edge of edge e. This is the estimate from the previous epoch. Node u is in the epoch. In the group and The set of neighboring nodes related to the middle edge is The edges in the graph can be divided into three groups: all edges, predicted normal edges, and predicted abnormal edges, i.e., g∈{*,0,1}. For each of the three groups of edges g∈{*,0,1}, intra-group aggregation and inter-group aggregation are performed respectively. The aggregation process is shown in the attached figure. Figure 2 As shown.

[0083] Furthermore, the intra-group aggregation method involves first aggregating all neighboring nodes with the central node, while simultaneously introducing a time window and a time-series decay mechanism. Node features are updated through the aggregation of the average of neighboring messages, as detailed in the following formula:

[0084]

[0085] Among them Agg mean || represents mean aggregation, and || represents feature concatenation. It is the weight matrix in the aggregation operation, and ReLU is the activation function.

[0086] For a specific group The node features will be aggregated twice more based on different groups, and the update method is as follows:

[0087]

[0088] Furthermore, the method for inter-group aggregation is defined as follows: an attention mechanism is introduced to gather information from all groups to obtain the l-th layer embedding of the node, and the specific calculation formula is as follows:

[0089]

[0090] and It is the weight matrix for the two grouping and aggregation operations, q is the learnable parameter vector, and T represents the transpose operation.

[0091] Furthermore, for each edge e = (u, v), the edge embedding vector is updated as follows:

[0092]

[0093] S4. Calculate the loss function;

[0094] After the above grouping and aggregation calculations, the final edge embedding vector is obtained. The final edge embedding vector The input is fed into a multilayer perceptron (MLP) to obtain the edge prediction value p. e , representing the probability that an edge is predicted as an anomaly. Then, cross-entropy classification loss is used for optimization, with the loss function defined as:

[0095]

[0096] The above model is used to predict the category of all edges, and a corresponding predicted probability p is generated for each edge. e Set a decision threshold θ, if p e If the edge is greater than θ, then the edge is predicted as an anomalous network flow (i.e., ...). Conversely, it is predicted as normal network flow (i.e., ...). ).

[0097] Finally, the prediction results for all edges are expressed as follows:

[0098] S5. Perform edge prediction task;

[0099] Furthermore, all network flow edges in the network flow dataset are partitioned into training, validation, and test sets in a 4:2:4 ratio. The Adam optimizer is used to train the neural network through multiple epochs to update the parameters. The model performance in each epoch is recorded, and the performance of the model is evaluated using precision, recall, and F1 score. The model with the lowest validation loss is saved for test set prediction, and finally, a network flow anomaly detection model is obtained.

[0100] In this embodiment, under an extreme imbalance network flow data scenario where normal traffic accounts for over 95%, the verification results are shown in the table below:

[0101]

[0102] The method proposed in this invention shows a significant improvement over NEGSC (non-patent literature Xu, Renjie, et al. "Applying self-supervised learning to network intrusion detection for network flows with graph neural network." Computer Networks 248(2024):110495.). The model of this invention achieves F1 scores of 0.8432, recall of 0.8783, and precision of 0.8110 for anomalous traffic, representing improvements of 36.8%, 50.3%, and 24.3% respectively compared to the corresponding NEGSC metrics (0.6165, 0.5844, and 0.6524). This indicates that the network traffic anomaly detection method proposed in this invention can more accurately identify anomalous traffic when processing imbalanced network traffic datasets, especially exhibiting stronger robustness and accuracy in scenarios with diverse attack types and large traffic fluctuations.

[0103] The above description is merely for illustrating embodiments of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the present invention should be included within the scope of protection of the claims of the present invention.

Claims

1. A method for detecting network traffic anomalies based on time-decrease adaptive side packets, comprising the following steps: S1. Network flow data preprocessing; Based on the collected NetFlow format network traffic data, IP addresses and ports are standardized, flow attributes with non-additive properties are binned using decision tree and the attribute value range is dynamically grouped, and the remaining flow attributes are target encoded. S2. Construct network flow interaction graph data; using network devices as nodes and communication behaviors between network devices as edges, obtain the original graph structure; sample the original graph by edges, and construct training graph data containing the sampled edges and their two local subgraphs as the model; S3. Calculate the embedding vectors of deep nodes and edges in the graph; after initializing the node and edge features in the graph, design a graph neural network algorithm with heterogeneous edge adaptive grouping based on the time window and time-series decay mechanism to perform information transfer between nodes and update edge embedding vectors; specifically including: S31: Based on the prediction results of the model in the previous Epoch, all neighbor edges in the current graph are grouped according to their prediction categories, namely, predicted normal edges, predicted abnormal edges, and all edges. Then, intra-group aggregation and inter-group aggregation are performed respectively. The neighbor edge grouping specifically includes: taking all edges that share an endpoint with the target edge as neighbor edges, i.e., if the edge... Then the neighbor edge refers to the node containing the node. or Edges; based on the flow timestamp, neighbor edges and nodes are arranged according to the time window. Dynamic grouping is performed; in the network interaction graph, each node... In the time window The set of all neighbors is ; Each central edge The set of neighboring edges is The set consists of two sets of edges, namely: in It is the edge In the time window The set of all neighboring edges, Indicates the first In the group within the time window edge The set of neighbor edges; at the end of each training epoch, all edges are classified according to the predictions of the current model, and these classification results are used to adjust the neighbor groupings in the next training round; if ,but ;if ,but ;in For the edge The neighbor's side, This is an estimate from a previous epoch; node In the In the group and The set of neighbor nodes related to the edge in the equation is: The edges in the graph are divided into three groups: all edges, predicted normal edges, and predicted abnormal edges. ; S32: Intra-group aggregation is used to aggregate all neighbor nodes with the central node once, while introducing a time window and time-series decay mechanism, and updating node characteristics by aggregating the average of neighbor messages; S33: Use inter-group aggregation and introduce an attention mechanism to gather information from all groups and calculate the updated node embedding vector in the current layer; S34: The edge embedding vector of the target edge is updated by concatenating the node embedding vector of the computation institute with the edge embedding vector of the previous layer. S4. Calculate the loss function; use a multilayer perceptron to calculate the final prediction result, inputting the edge embedding vector from step S3, and outputting the prediction score after passing through the Sigmoid function. Set decision threshold To determine whether the target edge is an abnormal edge, cross-entropy classification loss is used for optimization. S5. Perform the edge prediction task; divide the data in the network flow dataset into training, validation and test sets, use the Adam optimizer to train for multiple epochs to update the parameters in the neural network, record the model performance in each epoch, evaluate the model performance, save the model with the best average performance, and finally obtain the network flow anomaly detection model.

2. The network traffic anomaly detection method based on time-decay adaptive edge grouping as described in claim 1, characterized in that, Step S1 specifically includes: The original NetFlow format data includes source / destination IP, source / destination port, protocol type, number of bytes, number of packets, duration, and flow rate. IP and port attributes are standardized. Attributes with clear identifiers or categories are encoded using target encoding. Attributes with non-additive characteristics (maximum / minimum, time, and ratio categories) are encoded using decision tree binning. Decision tree classification is performed using learned label information. Segmentation condition values ​​are sorted in ascending order to determine the grouping range and number of features. The input feature values ​​are converted to one-hot encoding based on binning boundaries. The original edge features are... Convert to Finally, it is updated to a new edge feature representation. .

3. The network traffic anomaly detection method based on time-decay adaptive edge grouping as described in claim 1, characterized in that, Step S2 specifically includes: using the preprocessed network flow data from step S1, taking network devices as nodes, IP addresses and ports as node features, representing the communication behavior between source and destination nodes as edges, and using other flow features in the network flow records as edge features, finally generating a complete network interaction graph. ,in Indicates M edges, Let N nodes be represented by the edge feature matrix as follows: Each edge corresponds to 3D features, the node feature matrix is ​​represented as Each node corresponds to Dimensional features; the features of the m-th edge and the n-th node are represented as follows: The actual label of the corresponding edge is Where 0 represents benign traffic and 1 represents abnormal traffic; therefore, a set of edge features and true labels are represented as follows: The original graph is sampled by edges, and the sampled edges and their local subgraphs at both ends are constructed as training graph data for the model.

4. The network traffic anomaly detection method based on time-decay adaptive edge grouping as described in claim 1, characterized in that, The time-decaying aggregation method described in step S32 specifically includes: First, aggregating all neighbor nodes with the central node, while introducing a time window and a time decay mechanism; during aggregation, selecting neighbors within the time window and using the time decay mechanism to assign time decay weights to neighbors within the window; and using an exponential decay function. in For the current moment, For the neighbor's timestamp, The decay factor is used; node features are updated by aggregating the mean of neighbor messages, with the specific formula as follows: in Indicates mean aggregation, Indicates feature splicing, It is the weight matrix in the aggregation operation, and ReLU is the activation function; For a specific group The node features will be aggregated twice more based on different groups, and the update method is as follows: 。 5. The network traffic anomaly detection method based on time-decay adaptive edge grouping as described in claim 1, characterized in that, The inter-group aggregation method described in step S33 specifically includes: introducing an attention mechanism to gather information from all groups and obtaining the node's... Layer embedding, the calculation formula is: and It is the weight matrix of the two grouping aggregations. It is a learnable parameter vector. Indicates the transpose operation; Step S34, the edge embedding vector update, specifically includes: for each edge in the network flow interaction graph... The edge embedding vector is updated as follows: 。 6. The network traffic anomaly detection method based on time-decay adaptive edge grouping as described in claim 1, characterized in that, Step S4 specifically includes: embedding the final edge vector. The input is fed into a multilayer perceptron (MLP) to obtain the edge prediction value. , representing the probability that an edge is predicted as an anomaly; then, cross-entropy classification loss is used for optimization, with the specific formula as follows: The above model is used to predict the category of all edges, and a corresponding predicted probability is generated for each edge. Set a decision threshold ,if If the edge is predicted as an anomalous network flow, then... Conversely, it is predicted as normal network flow, i.e. Finally, the prediction results for all edges are expressed as follows: .

7. The network traffic anomaly detection method based on time-decay adaptive edge grouping as described in claim 1, characterized in that, Step S5 specifically includes: dividing all network flow edges in the network flow dataset into training, validation, and test sets in a 4:2:4 ratio; training the neural network using the Adam optimizer through multiple epochs to update the parameters; recording the model's performance in each epoch; evaluating the model's performance using precision, recall, and F1 score; saving the model with the lowest validation loss for test set prediction; and finally obtaining the network flow anomaly detection model.

8. A network traffic anomaly detection system based on time-decrease adaptive side-packets, characterized in that, include: The network flow data preprocessing module includes: standardizing IP addresses and ports based on the collected NetFlow format network traffic data; using decision tree binning encoding and dynamically grouping attribute value ranges for non-additive flow attributes; and performing target encoding processing on the remaining flow attributes. The network flow interaction graph data construction module includes: taking network devices as nodes and communication behaviors between network devices as edges to obtain the original graph structure; sampling the original graph by edges and constructing training graph data containing the sampled edges and their two local subgraphs as models; The module for calculating deep node and edge embedding vectors in the graph includes: initializing the node and edge features in the graph, and then designing a graph neural network method for adaptive grouping of heterogeneous edges based on time windows and time-series decay mechanisms to perform information transfer between nodes and update edge embedding vectors; specifically including: S31: Based on the prediction results of the model in the previous Epoch, all neighbor edges in the current graph are grouped according to their prediction categories, namely, predicted normal edges, predicted abnormal edges, and all edges. Then, intra-group aggregation and inter-group aggregation are performed respectively. The neighbor edge grouping specifically includes: taking all edges that share an endpoint with the target edge as neighbor edges, i.e., if the edge... Then the neighbor edge refers to the node containing the node. or Edges; based on the flow timestamp, neighbor edges and nodes are arranged according to the time window. Dynamic grouping is performed; in the network interaction graph, each node... In the time window The set of all neighbors is ; Each central edge The set of neighboring edges is The set consists of two sets of edges, namely: in It is the edge In the time window The set of all neighboring edges, Indicates the first In the group within the time window edge The set of neighbor edges; at the end of each training epoch, all edges are classified according to the predictions of the current model, and these classification results are used to adjust the neighbor groupings in the next training round; if ,but ;if ,but ;in For the edge The neighbor's side, This is an estimate from a previous epoch; node In the In the group and The set of neighbor nodes related to the edge in the equation is: The edges in the graph are divided into three groups: all edges, predicted normal edges, and predicted abnormal edges. ; S32: Intra-group aggregation is used to aggregate all neighbor nodes with the central node once, while introducing a time window and time-series decay mechanism, and updating node characteristics by aggregating the average of neighbor messages; S33: Use inter-group aggregation and introduce an attention mechanism to gather information from all groups and calculate the updated node embedding vector in the current layer; S34: The edge embedding vector of the target edge is updated by concatenating the node embedding vector of the computation institute with the edge embedding vector of the previous layer. The training loss function calculation module includes: using a multilayer perceptron to calculate the final prediction result, taking the edge embedding vector as input, and outputting the prediction score after passing it through a sigmoid function. Set decision threshold To determine whether the target edge is an abnormal edge, cross-entropy classification loss is used for optimization. The edge prediction task module includes: dividing the data in the network flow dataset into training, validation and test sets, using the Adam optimizer to train for multiple epochs to update the parameters in the neural network, recording the model performance in each epoch, evaluating the model performance, saving the model with the best average performance, and finally obtaining the network flow anomaly detection model.

Images