A network intrusion detection method, device and equipment

Abstract

The application provides a network intrusion detection method, device and equipment, belongs to the technical field of network security, and solves the problems of insufficient cross-modal feature fusion, weak complex attack modeling capability and poor self-adaptive capability of the traditional network intrusion detection method. The method comprises the following steps: acquiring network traffic data; preprocessing the network traffic data to obtain traffic data packets; extracting features from the traffic data packets to obtain a multi-modal feature set; performing point-line analysis and processing on the multi-modal feature set to obtain heterogeneous graph data; inputting the heterogeneous graph data into a detection model for processing to obtain a graph-level feature vector; and determining intrusion type data according to the graph-level feature vector. The scheme improves the detection accuracy of diversified attacks, enhances the structural perception capability of complex attacks, and improves the robustness and generalization.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a network intrusion detection method, device and equipment. BACKGROUND

[0002] In the field of modern network security, intrusion detection is a key link that affects the system protection capability, resource configuration efficiency and security response timeliness. Traditional network intrusion detection systems (NIDS) are usually based on signature-based intrusion detection systems (SIDS) and anomaly-based intrusion detection systems (AIDS). These methods have their own advantages and disadvantages. SIDS is severely dependent on a predefined feature library, so it is almost powerless when facing new attacks or mutated attack samples. AIDS analyzes the behavior patterns of network communication, which may miss more subtle attacks embedded in single data packet payloads. At the same time, the existing network intrusion detection methods of traditional machine learning-based NIDS technology focus on extracting static features from a single modality, making it difficult to fully utilize the complementary information between different modalities. In addition, most methods lack structural perception and adaptive feature fusion capability when modeling complex attack behaviors, making it difficult to accurately identify diversified intrusion patterns, and the precision of intrusion detection is low. SUMMARY

[0003] The present application provides a network intrusion detection method, device and equipment, which improves the precision and generalization ability of intrusion detection.

[0004] To solve the above technical problems, the technical solutions of the present application are as follows:

[0005] The present application provides a network intrusion detection method, device and equipment, which improves the precision and generalization ability of intrusion detection.

[0006] Obtaining network traffic data;

[0007] Preprocessing the network traffic data to obtain traffic data packets;

[0008] Feature extraction is performed on the traffic data packets to obtain a multi-modal feature set;

[0009] Point-line analysis and processing are performed on the multi-modal feature set to obtain heterogeneous graph data;

[0010] The heterogeneous graph data is input into a detection model for processing to obtain a graph-level feature vector;

[0011] According to the graph-level feature vector, determine intrusion type data.

[0012] Optionally, the network traffic data is obtained, including:

[0013] Data capture processing is performed on the preset network interface to obtain a traffic data file.

[0014] The traffic data file is parsed to obtain network traffic data.

[0015] Optionally, the network traffic data is preprocessed to obtain a traffic data packet, including:

[0016] The network traffic data is subjected to address filtering processing to obtain effective attack data.

[0017] The effective attack data is subjected to normalization processing to obtain a normalized data set.

[0018] The normalized data set is subjected to sample balancing processing to obtain a traffic data packet.

[0019] Optionally, feature extraction is performed on the traffic data packet to obtain a multi-modal feature set, including:

[0020] The traffic data packet is classified according to flow type to obtain flow data.

[0021] The flow data is subjected to feature statistical processing to obtain flow-level feature data.

[0022] The flow-level feature data is subjected to time series feature extraction processing to obtain time series feature data.

[0023] The traffic data packet is subjected to protocol identification processing to obtain protocol header metadata.

[0024] The traffic data packet is subjected to encoding processing to obtain payload encoding data.

[0025] The flow-level feature data and the time series feature data are integrated to obtain a plurality of first flow node feature vectors.

[0026] The protocol header metadata and the payload encoding data are integrated to obtain a plurality of first packet node feature vectors.

[0027] The plurality of first flow node feature vectors and the plurality of first packet node feature vectors are integrated to obtain a multi-modal feature set.

[0028] Optionally, the multi-modal feature set is subjected to point-line analysis processing to obtain heterogeneous graph data, including:

[0029] determine a plurality of flow nodes according to a plurality of first flow node feature vectors of the plurality of multi-modal feature sets, each flow node corresponding to a first flow node feature vector in a multi-modal feature set;

[0030] determine a plurality of packet nodes according to a plurality of first packet node feature vectors of the plurality of multi-modal feature sets, each packet node corresponding to a first packet node feature vector in a multi-modal feature set;

[0031] determine first edge data according to the subordinate relationship between the flow nodes and the packet nodes;

[0032] determine second edge data according to the time sequence adjacent relationship between the plurality of packet nodes;

[0033] integrate the first edge data and the second edge data to obtain edge set data;

[0034] update the first flow node feature vectors according to the first edge data to obtain second flow node feature vectors;

[0035] update the first packet node feature vectors according to the second edge data to obtain second packet node feature vectors;

[0036] integrate the second flow node feature vectors and the second packet node feature vectors to obtain node set data;

[0037] integrate the edge set data and the node set data to obtain heterogeneous graph data.

[0038] Optionally, the processing process of the detection model on the heterogeneous graph data includes:

[0039] perform graph convolution processing on the heterogeneous graph data to obtain node feature data;

[0040] perform batch normalization processing on the node feature data to obtain normalized feature data;

[0041] perform global pooling processing on the normalized feature data to obtain a graph-level feature vector.

[0042] Optionally, determining intrusion type data according to the graph-level feature vector includes:

[0043] perform linear transformation on the graph-level feature vector to obtain a representation tensor;

[0044] perform weight calculation on the representation tensor to obtain attention weight data;

[0045] perform weighted fusion processing on the graph-level feature vector according to the attention weight data to obtain a fused graph-level representation vector;

[0046] determine an intrusion detection result according to the fused graph-level representation vector.

[0047] The embodiment of the application further provides a network intrusion detection device, comprising:

[0048] an acquisition module, configured to acquire network traffic data;

[0049] a processing module, configured to pre-process the network traffic data to obtain traffic data packets, extract features from the traffic data packets to obtain a multi-modal feature set, perform point-line analysis processing on the multi-modal feature set to obtain heterogeneous graph data, input the heterogeneous graph data into a detection model for processing to obtain a graph-level feature vector;

[0050] a determination module, configured to determine intrusion type data according to the graph-level feature vector.

[0051] The embodiment of the application further provides a computing device, comprising a processor and a memory storing a computer program, wherein the computer program is executed by the processor to perform the method described above.

[0052] The embodiment of the application further provides a computer-readable storage medium storing instructions, wherein the instructions are executed on a computer to cause the computer to perform the method described above.

[0053] The technical scheme of the application at least has the following effects:

[0054] The above scheme of the application acquires network traffic data, pre-processes the network traffic data to obtain traffic data packets, extracts features from the traffic data packets to obtain a multi-modal feature set, performs point-line analysis processing on the multi-modal feature set to obtain heterogeneous graph data, inputs the heterogeneous graph data into a detection model for processing to obtain a graph-level feature vector, and determines intrusion type data according to the graph-level feature vector, thereby improving the detection accuracy of diversified network attacks, enhancing the structural perception ability of complex attacks, and improving robustness and generalization. BRIEF DESCRIPTION OF DRAWINGS

[0055] Figure 1 is a flowchart of a network intrusion detection method provided by the embodiment of the application;

[0056] Figure 2 is a data processing process schematic diagram of a network intrusion detection method provided by the embodiment of the application;

[0057] Figure 3 is a heterogeneous graph data construction process schematic diagram of a network intrusion detection method provided by the embodiment of the application;

[0058] Figure 4is a schematic diagram of information aggregation between detection model nodes of a network intrusion detection method provided by an embodiment of the present application.

[0059] Figure 5 is a structural diagram of a network intrusion detection device provided by an embodiment of the present application.

[0060] Figure 6 is a structural schematic diagram of a computing device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0061] Exemplary embodiments of the present application will be described in greater detail below with reference to the accompanying drawings. Although exemplary embodiments of the present application are shown in the drawings, it is understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that the present application can be more thoroughly understood, and the scope of the present application can be accurately conveyed to those skilled in the art.

[0062] As shown in Figure 1 and Figure 2 , an embodiment of the present application proposes a network intrusion detection method, comprising:

[0063] Step 11, obtaining network traffic data;

[0064] Step 12, preprocessing the network traffic data to obtain traffic data packets;

[0065] Step 13, extracting features from the traffic data packets to obtain a multi-modal feature set;

[0066] Step 14, performing point-line analysis processing on the multi-modal feature set to obtain heterogeneous graph data;

[0067] Step 15, inputting the heterogeneous graph data into a detection model for processing to obtain a graph-level feature vector;

[0068] Step 16, determining intrusion type data according to the graph-level feature vector.

[0069] In this embodiment, network traffic data is first obtained using network traffic collection software such as Wireshark, Snort, etc. Wireshark is a network protocol analysis tool that can capture network data packets in real time and provide detailed protocol analysis and filtering functions; Snort is an open-source network intrusion detection system that also has traffic collection capabilities and can capture and analyze traffic according to pre-set rules.

[0070] The collected raw network traffic data contains a large amount of noise, redundant information and data formats that do not meet the analysis requirements, and needs to be preprocessed; the purpose of preprocessing is to clean, convert and format these data, so that they are more suitable for subsequent feature extraction and analysis.

[0071] The preprocessing process can include data cleaning, removing duplicate packets, incorrect packets and packets irrelevant to intrusion detection;

[0072] Data segmentation, continuous network traffic data is segmented into individual packets according to certain rules; data format conversion, converting the collected network traffic data into a unified format to facilitate subsequent feature extraction algorithms for processing.

[0073] After obtaining the traffic data packets, the key information reflecting network behavior and intrusion characteristics is extracted from the traffic data packets to form a multi-modal feature set;

[0074] The feature extraction process can include statistical feature extraction, calculating the statistical features of the traffic data packets, such as packet size, packet number, packet arrival time interval, etc. For example, count the number of packets sent by a specific IP address in a period of time, if the number increases abnormally, it may mean that there is a network scanning or attack behavior. Protocol feature extraction, analyze the protocol type used by the traffic data packet and its related features. Different network protocols have different characteristics and behavior patterns, by extracting protocol features, abnormal protocol usage can be identified. For example, detecting the presence of protocol packets on a port that should not normally appear, may indicate an intrusion behavior. Content feature extraction, analyze the load content in the packet and extract content features. For example, through deep packet inspection technology, check whether the packet contains malicious code, attack instructions and other content features. Multi-modal fusion, fuse the above extracted statistical features, protocol features and content features, etc. to form a multi-modal feature set. The multi-modal feature set can comprehensively reflect the multiple aspects of network traffic, improve the accuracy and robustness of intrusion detection. For example, the packet size, protocol type and specific keywords in the load content can be combined to form a comprehensive feature vector.

[0075] After determining the multi-modal feature set, through point-line analysis processing, the multi-modal feature set is converted into a heterogeneous graph data structure that is easier for machine learning models to process.

[0076] The point line analysis processing process can include: node construction, different entities in the multi-modal feature set, such as IP addresses, port numbers, protocol types, etc., are taken as nodes in the graph. For example, each unique IP address is taken as a node, and each port number is also taken as a node. Edge construction, according to the relationship between entities, such as communication connection, protocol association, etc., the edges in the graph are constructed. For example, if there is a communication connection between two IP addresses, an edge is constructed between their corresponding nodes; if a certain data packet uses a specific protocol, an edge is constructed between the protocol node and the related IP address node. Heterogeneous graph generation, through the construction of the above nodes and edges, the heterogeneous graph data is generated. The heterogeneous graph can contain different types of nodes and edges, and can more comprehensively represent the complex relationships and patterns in network traffic. For example, in a heterogeneous graph, there can be nodes representing IP addresses, nodes representing protocols, and nodes representing ports, different types of nodes are connected by different types of edges to form a complex network structure.

[0077] After obtaining the heterogeneous graph data, it is input into the detection model for processing, and the detection model is used to process and analyze the heterogeneous graph data to determine whether there is an intrusion behavior in the network traffic, and output a graph-level feature vector. The specific process can include: model selection, selecting a deep learning model suitable for processing graph data, such as a graph neural network (GNN) model. The GNN model can effectively capture the node relationships and patterns in graph structure data, and has good applicability for network intrusion detection. Model training, using a large amount of labeled data to train the detection model, so that it learns the feature patterns of normal network traffic and intrusion network traffic. In the training process, the parameters of the model are continuously adjusted through optimization algorithms to improve the accuracy and generalization ability of the model. Result output, after inputting the heterogeneous graph data into the trained detection model, the model will output a graph-level feature vector. Each element in the vector can represent the probability or confidence of the network traffic belonging to different categories (such as normal, different intrusion types).

[0078] Finally, according to the graph-level feature vector, the type of network intrusion is determined. The specific process can include: threshold judgment, setting a suitable threshold, comparing the probability value in the graph-level feature vector with the threshold. If the probability value of a certain category exceeds the threshold, it is determined that the network traffic belongs to that category. Category mapping, according to the category corresponding to the maximum probability value in the graph-level feature vector, the intrusion type data is determined. For example, if the probability of "DDoS attack" is the highest in the graph-level feature vector, it is determined that the network traffic is of the DDoS attack type. Result feedback, the determined intrusion type data is fed back to the network administrator or security system, so as to take corresponding measures in time, such as blocking the attack source, repairing vulnerabilities, etc.

[0079] The scheme described in the embodiment constructs a network threat scene with high authenticity, such as distributed denial of service (DDoS), denial of service (DoS), network reconnaissance (Reconnaissance), web-based application layer attack (Web-based Attacks), brute-force (Brute-force), etc., by simulating the antagonistic interaction between an attacker and a target device. Secondly, multi-modal feature extraction and fusion, according to the attacker MAC address, only the traffic samples with the source MAC address or the destination MAC address matched with the known attacker address library are reserved as effective attack data, and finally the heterogeneous graph neural network (HGNN) is used to model the graph-level data, and the dynamic fusion of the two information modalities of the flow level and the packet level information is realized by means of the modal attention mechanism. This dynamic fusion mechanism enables the model to have autonomous judgment, ensuring that the model can comprehensively analyze the network behavior in a complex network environment, improve the detection accuracy of diversified attacks, enhance the structural perception ability of complex attacks, and improve the robustness and generalization.

[0080] In an optional embodiment of the application, step 11 can include:

[0081] Step 111, performing data capture processing on the preset network interface to obtain a traffic data file;

[0082] Step 112, performing parsing processing on the traffic data file to obtain network traffic data.

[0083] In the embodiment, first, a bottom library such as libpcap / WinPcap is used to listen to a specified interface and capture the original data packets flowing through, and the original data packets include link layer headers, IP / TCP headers, payloads and the like. The captured original data packets are saved as a standard format file such as a.pcap file, and the metadata such as timestamps and protocol types are retained.

[0084] After obtaining the traffic data file, the traffic data file is parsed and processed, including: link layer parsing to strip the Ethernet header; network layer parsing to extract the IP header; transport layer parsing to parse the TCP / UDP port, flag (such as SYN / ACK), sequence number, etc.; after parsing, the data packets are aggregated according to the five-tuple, i.e., source IP, destination IP, source port, destination port, protocol, etc., to generate network flows (Flows), and flow-level statistical features such as flow duration, total byte count, average packet size, packet rate, etc. are calculated. Finally, each flow or data packet is labeled for supervised learning.

[0085] In an optional embodiment of the application, step 12 can include:

[0086] Step 121, address filtering processing is performed on the network traffic data to obtain effective attack data;

[0087] Step 122, normalization processing is performed on the effective attack data to obtain a normalized data set;

[0088] Step 123, sample balancing processing is performed on the normalized data set to obtain a traffic data packet.

[0089] In this embodiment, the extracted original network traffic data is in the format of.pcap data.

[0090] In step 121, traffic samples with source MAC addresses or destination MAC addresses matched with a known attacker address library are retained as effective attack data, and any traffic associated with an attacker address is strictly excluded from being misclassified as a benign sample, thereby realizing address filtering processing on the network traffic data to obtain effective attack data.

[0091] In step 122, further normalization processing is performed on numerical features with as the core function, where μ represents the mean of the feature, and σ is the standard deviation. This conversion makes all features conform to a standard normal distribution with a mean of 0 and a standard deviation of 1, thereby eliminating the differences in dimensions and numerical ranges between different features.

[0092] In step 122, further random undersampling is performed on the majority class samples, and synthetic minority oversampling technique (SMOTE) is performed on the minority class samples; oversampling technique generates new samples with formula (1) core sample generation function to perform sample balancing processing on the normalized data set:

[0093] NewSample = OriginalSample + λ × (SelectedNeighbor - OriginalSample) (1)

[0094] Where: OriginalSample is a selected original sample point from the minority class, and a minority class sample is determined as the "center point"; SelectedNeighbor is a randomly selected neighbor sample from the K nearest neighbors of OriginalSample; NewSample is a new sample; λ is a random number between 0 and 1, used for linear interpolation between OriginalSample and SelectedNeighbor.

[0095] The new sample is integrated with the original data to obtain a traffic data packet.

[0096] In an optional embodiment of the application, step 13 can include:

[0097] Step 131, the flow data packets are classified according to the flow type, and flow data is obtained;

[0098] Step 132, the flow data is subjected to feature statistical processing, and flow-level feature data is obtained;

[0099] Step 133, the flow-level feature data is subjected to time sequence feature extraction processing, and time sequence feature data is obtained;

[0100] Step 134, the flow data packets are subjected to protocol identification processing, and protocol header metadata is obtained;

[0101] Step 135, the flow data packets are subjected to encoding processing, and payload encoding data is obtained;

[0102] Step 136, the flow-level feature data and the time sequence feature data are subjected to integration processing, and a plurality of first flow node feature vectors are obtained;

[0103] Step 137, the protocol header metadata and the payload encoding data are subjected to integration processing, and a plurality of first packet node feature vectors are obtained;

[0104] Step 138, the plurality of first flow node feature vectors and the plurality of first packet node feature vectors are subjected to integration processing, and a multi-modal feature set is obtained.

[0105] In this embodiment, first, the flow data packets are classified into independent flows (Flow) according to the five-tuple (source IP, destination IP, source port, destination port, protocol) through step 131, and flow data is obtained.

[0106] In step 132, the following statistical features are extracted for each flow: (1) basic statistical quantities, including connection duration, total transmission byte number, protocol type (such as TCP / UDP), and communication frequency; (2) packet-level derived features, including average packet size, TCPSYN packet ratio, and one-way packet ratio (for detecting DDoS attacks); a 76-dimensional flow-level feature vector containing the above statistical quantities is formed, and flow-level feature data is obtained.

[0107] In step 133, the 76-dimensional flow-level feature vector is segmented according to different time granularities (10s, 30s, 60s, 300s) sliding windows, and the following dynamic indicators are calculated in each window. The features of different time windows are spliced by dimension to form a time sequence feature vector, i.e., time sequence feature data, and this process can be represented as:

[0108] FlowFeature=[F 10s ,F 30s ,F 60s ,F 300s ]∈R 52 (2)

[0109] Wherein, FlowFeature is a 52-dimensional temporal feature vector, F 10s F 30s F 60s F 300s These are feature subsets under time windows of 10s, 30s, 60s, and 300s, respectively.

[0110] In step 134, the application layer protocol information of the traffic data packets is parsed using the nDPI library. The hostname and URL path are extracted from the HTTP traffic; the Server Name Indication (SNI) is extracted from the TLS traffic; and packet-level semantic features with 14-dimensional protocol header metadata are formed.

[0111] In step 135, the original payload of the traffic data packet is obtained, the payload length is uniformly truncated or padded to 1500 bytes, and each byte is converted into an integer value from 0 to 255 to form a 1500-dimensional packet-level payload feature vector, thus obtaining the payload encoded data.

[0112] In step 136, multiple 76-dimensional flow-level feature data are merged with 52-dimensional time-series feature data to form multiple 128-dimensional first-flow node feature vectors.

[0113] In step 137, multiple 14-dimensional packet-level semantic features are merged with 1500-dimensional payload encoding to form multiple 1514-dimensional first packet node feature vectors.

[0114] In step 138, a multimodal feature set is obtained based on multiple 128-dimensional flow-level features and 1514-dimensional packet-level features.

[0115] like Figure 3 As shown, in an optional embodiment of the present invention, step 14 may include:

[0116] Step 141: Based on the multiple first-flow node feature vectors of the multimodal feature set, determine multiple flow nodes, each flow node corresponding to a first-flow node feature vector in the multimodal feature set;

[0117] Step 142: Based on the multiple first packet node feature vectors of the multimodal feature set, determine multiple packet nodes, each packet node corresponding to a first packet node feature vector in the multimodal feature set;

[0118] Step 143: Determine the first side data based on the dependency relationship between the flow node and the packet node;

[0119] Step 144: Determine the second-side data based on the temporal adjacency relationship between the multiple packet nodes;

[0120] Step 145, integrating the first edge data and the second edge data to obtain edge set data;

[0121] Step 146, updating the first flow node feature vector according to the first edge data to obtain a second flow node feature vector;

[0122] Step 147, updating the first packet node feature vector according to the second edge data to obtain a second packet node feature vector;

[0123] Step 148, integrating the second flow node feature vector and the second packet node feature vector to obtain node set data;

[0124] Step 149, integrating the edge set data and the node set data to obtain heterogeneous graph data.

[0125] In this embodiment, in order to effectively utilize the extracted traffic level and packet level information, it is necessary to convert the extracted two modal features into a heterogeneous graph structure for input into a network model. The specific process includes:

[0126] In steps 141 and 142, a plurality of first flow node feature vectors and a plurality of first packet node feature vectors are determined according to the multi-modal feature set; wherein each first flow node feature vector represents a flow node v f corresponding to a network flow F; each first packet node feature vector represents a packet node v p corresponding to a data packet P i ;

[0127] In steps 143 and 144, the subordinate relationship of each flow node v f and packet node v p is traversed, if the packet node v p belongs to the flow node v f , then an edge e c (v f , v p ) ∈ ε c is added, indicating that the flow contains the data packet, ε c is the first edge data; if the i-th packet node v pi and the i+1-th v pi+ appear in the same flow and are continuous in time order, then an edge e c (v pi , v pi+ ) ∈ ε l is added, indicating a time sequence adjacent relationship, ε l is the second edge data;

[0128] In step 145, εc With ε l Integrating the above, we get the edge set data, i.e., ε = ε c ∪ ε l , where ε is the edge set data.

[0129] In steps 146 and 147, after determining the edge set data, the edge features are integrated into the flow nodes and the packet nodes. The corresponding information is transmitted through the aggregation of the node features. The aggregation of the node features and the first edge data ε c and the second edge data ε l is realized by the function ψ, and the specific process can be represented as:

[0130] v′ f = ψ(v f , {ε c (v f , v pi ) | 1≤i≤n}) (3)

[0131] v′ p = ψ(v p , {ε l (v pi , v po+1 ) | 1≤i<n}) (4)

[0132] wherein ε c (v f , v pi ) is the edge feature of the flow node v f and the packet node v pi , v′ f is the updated node feature of the flow node v f , ε l (v pi , v pi+1 ) is the edge feature of the packet node v pi+ and the packet node v pi , v′ p is the updated node feature of the packet node v p , and ψ is an aggregation function (such as mean pooling) for aggregating the packet node features to the flow node.

[0133] In step 148, the updated flow node v′ f is merged to determine the flow node set V f ; at the same time, the updated packet node v′ p is merged to determine the flow node set V p ; and: The updated node set is:

[0134] wherein V is a node set; and f,p is an edge set representing the connection relationship between nodes;

[0135] In step 149, the heterogeneous graph data G can be represented as:

[0136] G = (V, ε) (6)

[0137] In an optional embodiment of the present application, the processing process of the detection model on the heterogeneous graph data includes:

[0138] In step 151, the graph convolution processing is performed on the heterogeneous graph data to obtain node feature data;

[0139] In step 152, the batch normalization processing is performed on the node feature data to obtain normalized feature data;

[0140] In step 153, the global pooling processing is performed on the normalized feature data to obtain a graph-level feature vector.

[0141] In this embodiment, the basic structure of the detection model adopts a neural network model of a hypergraph structure, which can enable the packet-level micro features and flow-level macro features in the network traffic data to interact through the graph structure at a deeper level.

[0142] In step 151, the detection model adopts two layers of convolution operators, as shown in the following formula (7): Figure 4 Through the graph convolution operation, the information of the heterogeneous nodes can be effectively aggregated, and the local features of different types of nodes can be dynamically integrated by using the neighbor sampling and feature propagation mechanism, so as to capture the complex relationships between different types of nodes and edges in the network traffic graph.

[0143] Taking the flow node as an example, the information of the neighbor nodes of the packet neighbor nodes of the flow node is obtained by sampling the packet neighbor nodes of the flow node, and the mean aggregation function is used to aggregate these packet features to update the embedding vector of the node itself. At the same time, Batch Normalization (BN) is applied to each node type to alleviate the problem of gradient explosion or disappearance. The model will be introduced in the following layers:

[0144]

[0145] wherein, the output feature of the first layer of nodes; is the output feature of the second layer of nodes for each node type v ithe initial node features; A is the adjacency matrix; E is the adjacent edge; SAGEConv() is the SAGEConv convolution operator; σ() is a nonlinear activation function, and the LeakyReLU activation function is used in the model, which is given by formula (8). Compared with the ReLU activation function, the LeakyReLU activation function is more "tolerant" to negative values. By introducing nonlinearity, the model expression ability is improved, and the feature sparsity and nonlinearity are enhanced.

[0146]

[0147] wherein x is an input variable; and generally, a = 0.01.

[0148] The SAGEConv layer aggregates and updates the information of each node in the graph structure, so that the model can capture deeper connections between each node. The detection model uses two layers of graph convolution, and the node features of the lth layer are The update rule is:

[0149]

[0150] wherein, is the node feature data of the lth layer; represents any node; is a set of adjacent nodes connected through the edge E; W α and W β are the self-loop weight and neighbor aggregation weight, respectively, which are used to ensure that the model can not only retain the node's own information, but also absorb the neighbor context and information aggregation.

[0151] In this way, the flow node retains the original statistical characteristics under the action of W α , and learns the relationship pattern with the packet node through information aggregation. The packet node maintains its own effective information expression and perceives the interaction frequency with the flow node.

[0152] In step 152, after determining the node feature data, Batch Normalization (BN) is applied to each node type to alleviate the problem of gradient explosion or disappearance, and batch normalization processing is performed, as shown in formula (10). The node embedding matrix is standardized, and different BN layers are used to regulate different types of nodes.

[0153]

[0154] wherein μ and σ are the mean and standard deviation of the same type of node features in the current batch; γ and β are learnable scaling and offset parameters; ∈ is a very small constant to prevent the denominator from being zero, and generally, ∈ = 1 x 10 -5 .

[0155] In step 153, global pooling is a key operation in the graph neural network from node-level representation to graph-level representation, which is commonly used in graph classification tasks, can converge all node information in the graph, that is, all node embeddings in each graph are merged into a vector, and a dimension reduction operation is performed, which is an important operation before implementing the dynamic weight fusion mechanism. The specific process includes: let K be the Kth graph, then And And The feature representation of the node after the second layer convolution is The graph-level embedding of the two types of nodes is

[0156]

[0157] Wherein, is the graph-level representation of the flow node, representing the average of all flow node features in the Kth graph; is the graph-level representation of the package node, representing the average of all package node features in the Kth graph.

[0158] The graph-level representation of the flow node and the package node is spliced to form the final graph-level feature vector:

[0159] h graph (k) =[h f (k) ;h p (k) ]∈R 256 (13)

[0160] Wherein, h graph (k) is the graph-level feature vector.

[0161] In an optional embodiment of the application, the processing process of the detection model on the heterogeneous graph data includes:

[0162] Step 161, linearly transforming the graph-level feature vector to obtain a representation tensor;

[0163] Step 162, calculating the weight of the representation tensor to obtain attention weight data;

[0164] Step 163, according to the attention weight data, performing weighted fusion processing on the graph-level feature vector to obtain a fused graph-level representation vector;

[0165] Step 164, determining an intrusion detection result according to the fused graph-level representation vector.

[0166] In this embodiment, after the nodes are subjected to multiple rounds of information propagation and aggregation by the heterogeneous graph neural network, the detection model obtains graph-level representations of flow nodes and packet nodes, respectively. These two types of embeddings contain statistical behavior features and semantic content features. Different types of attacks depend on different modalities. For the Brute Force attack type, the attacker often tries to submit login requests continuously within a short period of time. Such login requests are usually contained in the payload of the packet modality, as the payload contains the username and password fields, as shown in Table 1. Therefore, it is necessary to learn an adaptive attention mechanism to assign appropriate weights to each modality, and then generate a unified fusion graph representation for use by the downstream classifier.

[0167] Table 1 Different modality preferences of various attack types

[0168]

[0169] Mapping the embeddings of the two modalities to the same dimension Hidden space is a prerequisite for the attention mechanism. Since the graph-level embeddings h f and h p of the two different modalities after global average pooling are different, their original representations cannot be directly compared semantically. Therefore, it is necessary to project the two different modalities into a common semantic space through linear transformation to provide a "comparable" space for subsequent attention allocation.

[0170] By using trainable projection weight matrices W f and W p and bias terms b f and b p in step 161, the modality embeddings are mapped to the same dimension and distribution, and the projection results are stacked and concatenated into a tensor. Each batch will obtain a 2xd' modality representation combination Z. The specific calculation formula is:

[0171]

[0172] where z f is the linear transformation result of the flow modality; z p is the linear transformation result of the packet modality; and Z is a tensor containing the semantic alignment representations of the two modalities, which are used for subsequent attention calculation.

[0173] In step 162, a shared attention mechanism (Shared Attention) is used, i.e., the same parameter W a is used to score the two modality representations. The reason for choosing shared rather than independent attention is to avoid artificial bias while ensuring that the attention is relatively measured to determine which modality is more important. The attention weight calculation formula is:

[0174]

[0175] wherein, a is the attention weight; a f is the flow modality weight; a p is the packet modality weight; softmax() is a normalization function. To enhance the model discrimination, a tanh function is added for nonlinear mapping, and a softmax normalization function is added, so as to obtain the attention weight.

[0176] In step 163, according to the attention weight, the detection model is weighted and fused between the two modalities to obtain the final fused graph-level representation h ζ , and the specific formula is:

[0177] h ζ = a f · h f + a p · h p (16)

[0178] The graph-level representation h ζ retains the information of the two modalities, and automatically highlights the more important modality features through the learnable weight.

[0179] In step 164, the graph-level representation h ζ will generate a final classification output through a series of fully connected layers to determine the intrusion detection result, and the specific formula is:

[0180] Out = LogSoftmax (W2·ReLU (W1·ReLU (W0·h ζ ))) (17)

[0181] wherein, W0, W1 and W2 are the weight matrices of the fully connected layers, and LogSoftmax() converts the final output into a category probability.

[0182] This heterogeneous graph framework effectively integrates packet-level and flow-level information, and performs information aggregation and representation learning in the heterogeneous graph structure, capturing deeper network interaction features. Through the attention mechanism, the fusion is dynamically weighted, so as to realize adaptive modeling of modality preference in different attack types and improve the classification accuracy. The accuracy, recall rate and F1 value of the detection model for eight different classification results are shown in Table 2.

[0183] Table 2 Classification results of the detection model

[0184] Attack Type Accuracy Recall F1 Value Benign 0.98 0.99 0.98 Web Based 0.93 0.99 0.96 Spoofing 0.98 0.98 0.98 Recon 0.99 0.93 0.96 Mirai 1.00 1.00 1.00 Dos 1.00 1.00 1.00 DDos 1.00 1.00 1.00 Brute Force 1.00 1.00 1.00

[0185] The network intrusion detection method provided by the application is based on an attention-driven dynamic fusion mechanism, can adaptively balance the weights of Flow and Packet modes, improves the detection accuracy of diversified attacks (such as DDoS and SQL injection), and uses a heterogeneous graph neural network (HGNN) to model the interaction relationship between flow and packet nodes, enhances the structural perception ability of complex attacks such as APT, and simultaneously uses a multi-scale sliding window to extract time sequence features, combines SMOTE and undersampling to solve the data imbalance problem, and reduces noise interference; the end-to-end processing flow from original flow to graph structure supports large-scale deployment, and improves the practicability of the model in a real network environment.

[0186] As shown in Figure 5 The application embodiment further provides a network intrusion detection device 50, which comprises:

[0187] An acquisition module 51 is configured to acquire network flow data.

[0188] A processing module 52 is configured to pre-process the network flow data to obtain flow data packets, extract features from the flow data packets to obtain a multi-modal feature set, perform point-line analysis and processing on the multi-modal feature set to obtain heterogeneous graph data, input the heterogeneous graph data into a detection model for processing to obtain a graph-level feature vector.

[0189] A determination module 53 is configured to determine intrusion type data according to the graph-level feature vector.

[0190] Optionally, the acquisition module 51 is specifically configured to:

[0191] Capture and process data of a preset network interface to obtain a flow data file.

[0192] Parse and process the flow data file to obtain network flow data.

[0193] Optionally, the processing module 52 is specifically configured to:

[0194] Filter addresses of the network flow data to obtain effective attack data.

[0195] Normalize the effective attack data to obtain a normalized data set.

[0196] Balance samples of the normalized data set to obtain flow data packets.

[0197] Optionally, the processing module 52 is further specifically configured to:

[0198] Classify the flow data packets according to flow types to obtain flow data.

[0199] performing feature statistical processing on the flow data to obtain flow-level feature data;

[0200] performing time sequence feature extraction processing on the flow-level feature data to obtain time sequence feature data;

[0201] performing protocol identification processing on the flow data packet to obtain protocol header metadata;

[0202] performing encoding processing on the flow data packet to obtain payload encoding data;

[0203] integrating the flow-level feature data and the time sequence feature data to obtain a plurality of first flow node feature vectors;

[0204] integrating the protocol header metadata and the payload encoding data to obtain a plurality of first packet node feature vectors;

[0205] integrating the plurality of first flow node feature vectors and the plurality of first packet node feature vectors to obtain a multi-modal feature set.

[0206] Optionally, the processing module 52 is further configured to:

[0207] determining a plurality of flow nodes according to the plurality of first flow node feature vectors of the multi-modal feature set, each flow node corresponding to a first flow node feature vector in the multi-modal feature set;

[0208] determining a plurality of packet nodes according to the plurality of first packet node feature vectors of the multi-modal feature set, each packet node corresponding to a first packet node feature vector in the multi-modal feature set;

[0209] determining first edge data according to the subordinate relationship between the flow nodes and the packet nodes;

[0210] determining second edge data according to the time sequence adjacent relationship between the plurality of packet nodes;

[0211] integrating the first edge data and the second edge data to obtain edge set data;

[0212] performing update processing on the first flow node feature vector according to the first edge data to obtain second flow node feature vectors;

[0213] performing update processing on the first packet node feature vector according to the second edge data to obtain second packet node feature vectors;

[0214] integrating the second flow node feature vectors and the second packet node feature vectors to obtain node set data;

[0215] Integrate the edge set data and the node set data to obtain heterogeneous graph data.

[0216] Optionally, the processing process of the detection model on the heterogeneous graph data comprises:

[0217] Perform graph convolution processing on the heterogeneous graph data to obtain node feature data;

[0218] Perform batch normalization processing on the node feature data to obtain normalized feature data;

[0219] Perform global pooling processing on the normalized feature data to obtain a graph-level feature vector.

[0220] Optionally, the determining module 53 is further configured to:

[0221] Perform linear transformation on the graph-level feature vector to obtain a representation tensor;

[0222] Perform weight calculation on the representation tensor to obtain attention weight data;

[0223] According to the attention weight data, perform weighted fusion processing on the graph-level feature vector to obtain a fused graph-level representation vector;

[0224] According to the fused graph-level representation vector, determine an intrusion detection result.

[0225] It should be noted that the apparatus corresponds to the above method, and all implementation manners in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0226] As shown in Figure 6 The embodiment of the application further provides a computing device 60, which comprises a processor 61, a memory 62, a program or instruction stored in the memory 62 and executable on the processor 61, and the program or instruction is executed by the processor 61 to implement the processes of the above network intrusion detection method embodiments and can achieve the same technical effects. To avoid repetition, it will not be described here. It should be noted that the computing device in the embodiment of the application comprises the above mobile electronic device and non-mobile electronic device.

[0227] Those skilled in the art can realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the application.

[0228] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the system, device and unit described above can refer to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

[0229] In the embodiments provided by the present application, it should be understood that the disclosed device and method can be implemented in other ways. For example, the device embodiments described above are merely schematic, for example, the division of units is only a logical function division, and there can be another division manner in actual implementation, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, device or unit, and can be electrical, mechanical or in other forms.

[0230] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0231] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically independently, or two or more units can be integrated into one unit.

[0232] If the functions are realized in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the parts of the present application that essentially contribute to the prior art or the parts of the technical solutions can be embodied in the form of software products. The computer software product is stored in a storage medium, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the embodiments of the method of the present application. The foregoing storage medium includes: U disk, mobile hard disk, ROM, RAM, magnetic disk or optical disk, and various program code storage media.

[0233] Moreover, it is pointed out that in the device and method of the present application, obviously, the components or steps can be decomposed and / or recombined. These decompositions and / or recombination should be considered as equivalent solutions of the present application. Also, the steps of performing the above series of processes can naturally be executed in time sequence according to the order of description, but do not need to be necessarily executed in time sequence. Some steps can be executed in parallel or independently of each other. It can be understood by those skilled in the art that all or any steps or components of the method and device of the present application can be realized in hardware, firmware, software or a combination thereof in any computing device (including processors, storage media, etc.) or network of computing devices, using the basic programming skills of those skilled in the art upon reading the description of the present application.

[0234] Therefore, the object of the present application can also be realized by running a program or a set of programs on any computing device. The computing device can be a commonly known general-purpose device. Therefore, the object of the present application can also be realized only by providing a program product containing program code for realizing the method or device. That is, such a program product also constitutes the present application, and a storage medium storing such a program product also constitutes the present application. Obviously, the storage medium can be any commonly known storage medium or any storage medium developed in the future. It is also pointed out that in the device and method of the present application, obviously, the components or steps can be decomposed and / or recombined. These decompositions and / or recombination should be considered as equivalent solutions of the present application. Also, the steps of performing the above series of processes can naturally be executed in time sequence according to the order of description, but do not need to be necessarily executed in time sequence. Some steps can be executed in parallel or independently of each other.

[0235] The above is the preferred embodiment of the present application. It should be pointed out that for those skilled in the art, several improvements and refinements can be made without departing from the principles of the present application, and these improvements and refinements should also be considered as the protection scope of the present application.

Claims

1. A network intrusion detection method, characterized in that, include: Obtain network traffic data; The network traffic data is preprocessed to obtain traffic data packets; Feature extraction is performed on the traffic data packets to obtain a multimodal feature set; The multimodal feature set is subjected to point-line analysis to obtain heterogeneous graph data, specifically including: Based on the feature vectors of multiple first-flow nodes in the multimodal feature set, multiple flow nodes are determined, and each flow node corresponds to a feature vector of a first-flow node in the multimodal feature set. Based on the feature vectors of multiple first packet nodes in the multimodal feature set, multiple packet nodes are determined, and each packet node corresponds to a feature vector of a first packet node in the multimodal feature set. Determine the data for the first side based on the dependency relationship between the flow node and the packet node; The second-side data is determined based on the temporal adjacency relationship between the multiple packet nodes; The first edge data and the second edge data are integrated to obtain the edge set data; Based on the first edge data, the feature vector of the first flow node is updated to obtain the feature vector of the second flow node. Based on the second side data, the feature vector of the first packet node is updated to obtain the feature vector of the second packet node. The feature vectors of the second stream nodes and the feature vectors of the second packet nodes are integrated to obtain node set data; The edge set data and the node set data are integrated and processed to obtain heterogeneous graph data; The multimodal feature set includes a first flow node feature vector obtained based on flow-level statistical features and a first packet node feature vector obtained based on packet content features; The heterogeneous graph data is input into the detection model for processing to obtain graph-level feature vectors. Based on the graph-level feature vectors, the intrusion type data is determined.

2. The network intrusion detection method according to claim 1, characterized in that, Obtain network traffic data, including: Data capture and processing are performed on the preset network interface to obtain a traffic data file; The traffic data file is parsed to obtain network traffic data.

3. The network intrusion detection method according to claim 1, characterized in that, The network traffic data is preprocessed to obtain traffic data packets, including: The network traffic data is subjected to address filtering to obtain valid attack data; The valid attack data is normalized to obtain a normalized dataset; The normalized dataset is subjected to sample equalization processing to obtain traffic data packets.

4. The network intrusion detection method according to claim 3, characterized in that, Feature extraction is performed on the traffic data packets to obtain a multimodal feature set, including: The traffic data packets are classified and processed according to flow type to obtain flow data; The streaming data is subjected to feature statistical processing to obtain streaming-level feature data; The flow-level feature data is subjected to time-series feature extraction processing to obtain time-series feature data; The traffic data packets are processed for protocol identification to obtain protocol header metadata; The traffic data packets are encoded to obtain payload encoded data; The flow-level feature data and the time-series feature data are integrated and processed to obtain multiple first-flow node feature vectors; The protocol header metadata and the payload encoded data are integrated and processed to obtain multiple first packet node feature vectors; The feature vectors of the multiple first-flow nodes and the feature vectors of the multiple first-packet nodes are integrated to obtain a multimodal feature set.

5. The network intrusion detection method according to claim 1, characterized in that, The detection model's processing of the heterogeneous graph data includes: The heterogeneous graph data is subjected to graph convolution processing to obtain node feature data; The node feature data is batch normalized to obtain normalized feature data; The normalized feature data is subjected to global pooling to obtain graph-level feature vectors.

6. The network intrusion detection method according to claim 1, characterized in that, Based on the graph-level feature vectors, the intrusion type data is determined, including: A linear transformation is performed on the graph-level eigenvectors to obtain the representation tensor; Weights are calculated on the representation tensor to obtain attention weight data; Based on the attention weight data, the graph-level feature vector is weighted and fused to obtain the fused graph-level representation vector; The intrusion detection result is determined based on the fused graph-level representation vector.

7. A network intrusion detection device, characterized in that, include: The acquisition module is used to acquire network traffic data; The processing module is used to preprocess the network traffic data to obtain traffic data packets; Feature extraction is performed on the traffic data packets to obtain a multimodal feature set; point and line analysis is performed on the multimodal feature set to obtain heterogeneous graph data; the heterogeneous graph data is input into the detection model for processing to obtain graph-level feature vectors; The determination module is used to determine the intrusion type data based on the graph-level feature vector; Specifically, the heterogeneous graph data obtained by performing point-line analysis on the multimodal feature set includes: Based on the feature vectors of multiple first-flow nodes in the multimodal feature set, multiple flow nodes are determined, and each flow node corresponds to a feature vector of a first-flow node in the multimodal feature set. Based on the feature vectors of multiple first packet nodes in the multimodal feature set, multiple packet nodes are determined, and each packet node corresponds to a feature vector of a first packet node in the multimodal feature set. Determine the data for the first side based on the dependency relationship between the flow node and the packet node; The second-side data is determined based on the temporal adjacency relationship between the multiple packet nodes; The first edge data and the second edge data are integrated to obtain the edge set data; Based on the first edge data, the feature vector of the first flow node is updated to obtain the feature vector of the second flow node. Based on the second side data, the feature vector of the first packet node is updated to obtain the feature vector of the second packet node. The feature vectors of the second stream nodes and the feature vectors of the second packet nodes are integrated to obtain node set data; The edge set data and the node set data are integrated and processed to obtain heterogeneous graph data; The multimodal feature set includes a first flow node feature vector obtained based on flow-level statistical features and a first packet node feature vector obtained based on packet content features.

8. A computing device, characterized in that, include: A processor, a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The system stores instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1 to 6.

Images